[HDFS-11302] Improve Logging for SSLHostnameVerifier

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.9.0, 3.0.0-alpha4
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Chen Liang
• Reporter: Xiaoyu Yao
• Created: 06/Jan/17 23:05
• Updated: 17/Apr/17 15:41
• Resolved: 06/Apr/17 00:29

Description

SSLHostnameVerifier interface/class was copied from other projects without any logging to help troubleshooting SSL certificate related issues. For a misconfigured SSL truststore, we may get some very confusing error message like

>hdfs dfs -cat swebhdfs://NNl/tmp/test1.txt
...
cause:java.io.IOException: DN2:50475: HTTPS hostname wrong:  should be <DN2>
cat: DN2:50475: HTTPS hostname wrong:  should be <DN2>

This ticket is opened to add tracing to give more useful context information around SSL certificate verification failures inside the following code.

AbstractVerifier#check(String[] host, X509Certificate cert)