[HIVE-13044] Enable TLS encryption to HMS backend database

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.1.0
• Component/s: Metastore
• Labels: TODOC2.1

Release Note

HIVE-13044 (Enable TLS encryption to HMS backend database) adds a new hive-site.xml propertity hive.metastore.dbaccess.ssl.properties which simplifies the SSL configuration on the HMS side. SSL client configuration can be setup by configuring two hive-site.xml properties javax.jdo.option.ConnectionURL and hive.metastore.dbaccess.ssl.properties.

javax.jdo.option.ConnectionURL specifies the connection string for HMS to connect to the database. To enable SSL, the client SSL flag(s) or certain protocol need to add to the connection string.

hive.metastore.dbaccess.ssl.properties When SSL is enabled in the connection string, some SSL properties such as key store location or key store password, need to pass in as the system properties. This configuration allows the user to pass in the list of the necessary SSL properties depending on how the database is configured to secure the connection. e.g., if mutual authentication is needed between the client (HMS) and the server (database), javax.net.ssl.keyStore needs to be specified to authenticate the client against the server as well as javax.net.ssl.trustStore to authenticate the server against the client.

• Assignee: Aihua Xu
• Reporter: Aihua Xu
• Created: 11/Feb/16 17:21
• Updated: 30/Nov/18 23:09
• Resolved: 23/Feb/16 14:43

Description

When the database like mysql enables TLS/SSL encryption, we should provide some configuration properties like the ones to HS2 to enable that. Right now, I think we can enable that through javaopts and connection url.

Issue Links

• causes: HIVE-20992 Split the config "hive.metastore.dbaccess.ssl.properties" into more meaningful configs