[HDDS-6030] Support for External Root CA

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.2.0
• Component/s: OM, Ozone Datanode, SCM, Security
• Labels: pull-request-available
• Target Version/s: 1.3.0
• Assignee: Vivek Ratnavel Subramanian
• Reporter: Vivek Ratnavel Subramanian
• Created: 23/Nov/21 00:33
• Updated: 15/Oct/22 11:34
• Resolved: 15/Oct/22 11:34

Description

Currently, Ozone brings its own CA and intermediate CAs through SCM instances when security is enabled and doesn't support deployments with an existing Root CA. Oftentimes enterprise customers have their own root CA and intermediate CAs set up and configured to sign the certificates within their organization.

This jira can be used to track this feature of supporting external Root CA in Ozone. This feature might require changes or updates to the security bootstrap flow of all the components. And, hence the feature can be tracked in a separate branch.

More details are added to the design doc attached.
External root CA support - Design Doc v1.pdf

Issue Links

• relates to: HDDS-7331 Ozone PKI improvements
• supercedes: HDDS-2731 Certificate Revocation Support for Ozone CA
• links to: GitHub Pull Request #2962