[HDDS-3997] Ozone certificate needs additional flags and SAN extension for GRPC TLS.

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Labels: pull-request-available
• Target Version/s: 1.0.0
• Assignee: Xiaoyu Yao
• Reporter: Xiaoyu Yao
• Created: 22/Jul/20 00:17
• Updated: 25/Jul/20 00:07
• Resolved: 25/Jul/20 00:07

Description

Current Ozone certificate are good for sign/verify tokens but can't do SSL handshake.

Here are a few missing pieces:
1. Caused by: java.security.cert.CertificateException: No subject alternative names present
at java.base/sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:137)

2. Caused by: sun.security.validator.ValidatorException: KeyUsage does not allow digital signatures
at java.base/sun.security.validator.EndEntityChecker.checkTLSServer(EndEntityChecker.java:278)

Issue Links

• links to: GitHub Pull Request #1235