[IMPALA-3870] Impala cannot validate the SSL hostname provided in the SubjectAltName field in the certificate

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Duplicate
• Affects Version/s: Impala 2.5.0
• Component/s: Security
• Labels: X509 certificate ssl subjectAltName
• Assignee: Unassigned
• Reporter: František Dvořák
• Created: 18/Jul/16 16:35
• Updated: 18/Jul/16 16:48
• Resolved: 18/Jul/16 16:48

Description

Hostnames provided in "Subject Alternative Name" field in certificates are not used for validation so validating fails when subjectAltName is used.

Error returned from impala-shell when using --ca_cert:

Error connecting: TTransportException, Hostname we connected to "XXXX" doesn't match certificate provided commonName "XXXX"

It would be nice to support this. Although there is workaround:

• for impala: not using --ca_cert in impala-shell
• for hue: set 'impala.ssl.validate' to False