[HADOOP-14417] Update default SSL cipher list for KMS

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.9.0
• Fix Version/s: 2.9.0
• Component/s: kms, security
• Target Version/s: 2.9.0
• Assignee: John Zhuge Assign to me
• Reporter: John Zhuge
• Created: 12/May/17 14:21
• Updated: 15/May/17 23:31
• Resolved: 15/May/17 23:31

Description

In Oracle Linux 6.8 configurations, the curl command cannot connect to certain CDH services that run on Apache Tomcat when the cluster has been configured for TLS/SSL. Specifically, HttpFS, KMS, Oozie, and Solr services reject connection attempts because the default cipher configuration uses weak temporary server keys (based on Diffie-Hellman key exchange protocol).

https://www.cloudera.com/documentation/enterprise/release-notes/topics/cdh_rn_os_ki.html#tls_weak_ciphers_rejected_by_oracle_linux_6

Issue Links

• depends upon: HADOOP-14083 KMS should support old SSL clients
• is related to: HDFS-11816 Update default SSL cipher list for HttpFS