[HBASE-27280] Add mutual authentication support to TLS

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.6.0, 3.0.0-alpha-4
• Labels: patch-available security ssl tls

Release Note

By default, when TLS is enabled, we will also enable mutual authentication of certificates. This means, during handshake, the client will authenticate the server's certificate (as is usual) and also the server will authenticate the client's certificate. Additionally, each side will validate that the hostname presented by the certificate matches the address of the connection. These default settings can be customized with new properties "hbase.server.netty.tls.client.auth.mode" (default NEED, possibly values NEED, WANT, NONE), "hbase.server.netty.tls.verify.client.hostname" (default true), and "hbase.client.netty.tls.verify.server.hostname" (default true). Additionally, during hostname verification, if necessary we will fallback on reverse lookup. The reverse lookup can be disabled via "hbase.rpc.tls.host-verification.reverse-dns.enabled" (default true)

• Assignee: Bryan Beaudreault
• Reporter: Bryan Beaudreault
• Created: 07/Aug/22 21:26
• Updated: 24/Sep/22 19:33
• Resolved: 23/Sep/22 13:20

Description

With HBASE-26666 we now have native TLS on server and client. By default clients validate server certificate on handshake. This issue adds server authentication of clients. We can also add support for custom rules, such as cert CommonName validation.

I've already got a POC running of this, so assigning to me

Issue Links

• blocks: HBASE-27326 Add validation of request user and groups from TLS certificate
• fixes: HBASE-26548 Investigate mTLS in RPC layer
• links to: GitHub Pull Request #4724
• links to: GitHub Pull Request #4796