[HDFS-11418] HttpFS should support old SSL clients

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.8.0, 2.7.4, 2.6.6
• Fix Version/s: 2.9.0
• Component/s: httpfs
• Target Version/s: 2.9.0
• Assignee: John Zhuge
• Reporter: John Zhuge
• Created: 15/Feb/17 18:33
• Updated: 12/May/17 14:25
• Resolved: 02/Mar/17 04:00

Description

HADOOP-13812 upgraded Tomcat to 6.0.48 which filters weak ciphers. Old SSL clients such as curl stop working. The symptom is NSS error -12286 when running curl -v.

Instead of forcing the SSL clients to upgrade, we can configure Tomcat to explicitly allow enough weak ciphers so that old SSL clients can work.

Issue Links

• is broken by: HADOOP-13812 Upgrade Tomcat to 6.0.48
• is depended upon by: HDFS-11579 Make HttpFS Tomcat SSL property sslEnabledProtocols and clientAuth configurable
• is depended upon by: HDFS-11816 Update default SSL cipher list for HttpFS
• relates to: HADOOP-14083 KMS should support old SSL clients