[KAFKA-10279] Allow dynamic update of certificates with additional SubjectAltNames

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.7.0
• Component/s: security
• Assignee: Rajini Sivaram
• Reporter: Rajini Sivaram
• Reviewer: Manikumar
• Created: 16/Jul/20 19:27
• Updated: 21/Jul/20 09:37
• Resolved: 21/Jul/20 09:37

Description

At the moment, we don't allow dynamic keystore update in brokers if DN and SubjectAltNames don't match exactly. This is to ensure that existing clients and inter-broker communication don't break. Since addition of new entries to SubjectAltNames will not break any authentication, we should allow that and just verify that new SubjectAltNames is a superset of the old one.

Issue Links

• links to: GitHub Pull Request #9044