[HDFS-11816] Update default SSL cipher list for HttpFS

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.9.0
• Fix Version/s: 2.9.0
• Component/s: httpfs, security
• Target Version/s: 2.9.0
• Assignee: John Zhuge
• Reporter: John Zhuge
• Created: 12/May/17 14:25
• Updated: 15/May/17 23:32
• Resolved: 15/May/17 23:32

Description

In Oracle Linux 6.8 configurations, the curl command cannot connect to certain CDH services that run on Apache Tomcat when the cluster has been configured for TLS/SSL. Specifically, HttpFS, KMS, Oozie, and Solr services reject connection attempts because the default cipher configuration uses weak temporary server keys (based on Diffie-Hellman key exchange protocol).

https://www.cloudera.com/documentation/enterprise/release-notes/topics/cdh_rn_os_ki.html#tls_weak_ciphers_rejected_by_oracle_linux_6

Issue Links

• depends upon: HDFS-11418 HttpFS should support old SSL clients
• relates to: HADOOP-14417 Update default SSL cipher list for KMS