[HADOOP-16000] Remove TLSv1 and SSLv2Hello from the default value of hadoop.ssl.enabled.protocols

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.3.0
• Component/s: security
• Target Version/s: 3.3.0
• Hadoop Flags: Incompatible change, Reviewed
• Release Note: TLSv1 and SSLv2Hello were removed from the default value of "hadoop.ssl.enabled.protocols".
• Assignee: Gabor Bota
• Reporter: Akira Ajisaka
• Created: 12/Dec/18 05:05
• Updated: 24/Feb/22 05:58
• Resolved: 15/Dec/18 01:56

Description

core-default.xml

  public static final String SSL_ENABLED_PROTOCOLS_DEFAULT =
      "TLSv1,SSLv2Hello,TLSv1.1,TLSv1.2";

TLSv1 and SSLv2Hello are considered to be vulnerable. Let's remove these by default.

Issue Links

• is related to: HADOOP-15169 "hadoop.ssl.enabled.protocols" should be considered in httpserver2
• is related to: HADOOP-18140 Update default value of hadoop.ssl.enabled.protocols in the EncryptedShuffle doc
• is related to: HADOOP-16549 Remove Unsupported SSL/TLS Versions from Docs/Properties
• relates to: HADOOP-11243 SSLFactory shouldn't allow SSLv3
• relates to: HADOOP-12817 Enable TLS v1.1 and 1.2