[HADOOP-17699] Remove hardcoded SunX509 usage from SSLFactory

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: common
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.2
• Hadoop Flags: Reviewed
• Assignee: Xiaoyu Yao
• Reporter: Xiaoyu Yao
• Created: 15/May/21 00:05
• Updated: 27/Jan/24 06:01
• Resolved: 18/May/21 17:12

Description

In SSLFactory.SSLCERTIFICATE, used by FileBasedKeyStoresFactory and ReloadingX509TrustManager, there is a hardcoded reference to "SunX509" which is used to get a KeyManager/TrustManager. This KeyManager type might not be available if using the other JSSE providers, e.g.,  in FIPS deployment.

 

WARN org.apache.hadoop.hdfs.web.URLConnectionFactory: Cannot load customized ssl related configuration. Fall
 back to system-generic settings.
 java.security.NoSuchAlgorithmException: SunX509 KeyManagerFactory not available
 at sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
 at javax.net.ssl.KeyManagerFactory.getInstance(KeyManagerFactory.java:137)
 at org.apache.hadoop.security.ssl.FileBasedKeyStoresFactory.init(FileBasedKeyStoresFactory.java:186)
 at org.apache.hadoop.security.ssl.SSLFactory.init(SSLFactory.java:187)
 at org.apache.hadoop.hdfs.web.SSLConnectionConfigurator.<init>(SSLConnectionConfigurator.java:50)
 at org.apache.hadoop.hdfs.web.URLConnectionFactory.getSSLConnectionConfiguration(URLConnectionFactory.java:100)
 at org.apache.hadoop.hdfs.web.URLConnectionFactory.newDefaultURLConnectionFactory(URLConnectionFactory.java:79)

This ticket is opened to use the DefaultAlgorithm defined by Java system property: 

ssl.KeyManagerFactory.algorithm and ssl.TrustManagerFactory.algorithm.

 

Issue Links

• links to: GitHub Pull Request #3016