[HDDS-2731] Certificate Revocation Support for Ozone CA

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Abandoned
• Target Version/s: 1.3.0
• Assignee: Xiaoyu Yao
• Reporter: Marton Elek
• Created: 13/Dec/19 18:51
• Updated: 14/Oct/22 21:09
• Resolved: 09/Aug/22 04:44

Description

Currently, in Ozone, communication between Ozone Manager, SCM and Data Nodes takes place over TLS protocol, which is, through issued security artifacts i.e. X509 certificates. These certificates reside at SCM storage. The “known and trusted” data nodes are provisioned with corresponding certificates and for smooth communication in the system, these certificates are also stored on client certificate cache.   

Problem is, once these certificates are invalidated on SCM, whether its Admin or Expired Certs or Cert Rotation Process (future), these certs are not removed or invalidated on Data Node’s Local Cache. This means that tokens issues by Ozone Manager (OM), can still be used to access blocks from Data Nodes since the client certificate case still holds the invalidated certificate. 

Issue Links

• is superceded by: HDDS-6030 Support for External Root CA
• relates to: HDDS-7331 Ozone PKI improvements

Sub-Tasks

• Add class CRLCodec - used for certificate revocation list.: Resolved
• Add Unit Test cases for CRLCodec.: Resolved
• hdds.x509.CRL.name missing from ozone-default.xml: Resolved
• Add SCM CA CLI to query certificate: Resolved
• DN handle expired certificates when validate block token: Resolved
• OM handle expired certificate when verify token signature: Resolved
• SCM should be able to persist CRL: Resolved
• Add timestamp to Revoked Certs table in SCM DB: Resolved
• Revocation Certificate SCM HA: Resolved
• SCM security protocol support for query CRLs and latest CRL id for OM and Datanode.: Resolved
• CRLInfo should include CRL Sequence ID: Resolved
• Datanodes should be able to persist and load CRL: Resolved
• Add revokeCertificate to SCMSecurityProtocolServer: Resolved
• Datanodes should send last processed CRL sequence ID in heartbeats: Resolved
• Add SCM GRPC server to publish CRL update: Resolved
• Move SCMUpdateProtocol to hdds interface-server package: Resolved
• Handle CRLStatusReport got from DN heartbeats and persist them: Resolved
• Add SCM Cert CLI to revoke certificate: Resolved
• Datanodes should get new CRLs from SCM and process them: Resolved
• Datanodes should persist last processed CRL sequence id: Resolved
• DN handle revoke of its own certificate: Resolved
• OM handle revoke of its own certificate: Resolved
• Make Revoked Certs table change in SCM DB to be backward compatible: Resolved
• Add Audit to SCM SecurityProtocolServer: Resolved
• SCM background thread to check and handle delayed revocation: Resolved
• Add TLS TrustManager that honors CRL: Resolved
• Add TLS for GRPC based SCMUpdateService: Resolved
• Send command to Datanodes to process new CRL: Resolved