[IGNITE-7997] Ability to use different SSL trust store password and private key password

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.4
• Component/s: security
• Assignee: Unassigned
• Reporter: Ilya Kasnacheev
• Created: 20/Mar/18 08:43
• Updated: 20/Mar/18 08:44

Description

Currently, the same keyStorePwd is used for both trust store and private keys. For a while it is a usable approach. But sometimes these passwords are distinct and this should be supported by SslContextFactory. Tomcat faced the same issue and they eventually fixed it.

            KeyStore keyStore = loadKeyStore(keyStoreType, keyStoreFilePath, keyStorePwd);

            keyMgrFactory.init(keyStore, keyStorePwd);

Suggested config format:

    <bean class="org.apache.ignite.ssl.SslContextFactory">
      <property name="keyStoreFilePath" value="keystore/server.jks"/>
      <property name="keyStorePassword" value="123456"/>
      <property name="privateKeyPassword" value="234567"/>
      <property name="trustStoreFilePath" value="keystore/trust.jks"/>
      <property name="trustStorePassword" value="345678"/>
    </bean>

Issue Links

• is related to: IGNITE-2337 SSL & TLS use distinguished name of the certificate (DN)
• is related to: IGNITE-6167 Ability to enabled TLS protocols and cipher suites