[OAK-9451] Cold Standby SSL certificates should be configurable

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.8.25, 1.22.8, 1.42.0, 1.6.23
• Component/s: segment-tar
• Labels: cold-standby
• Assignee: Andrei Dulceanu
• Reporter: Axel Hanikel
• Created: 02/Jun/21 12:03
• Updated: 17/Dec/21 09:58
• Resolved: 04/Jun/21 15:50

Description

The cold standby is able to do SSL connections to the primary, but currently only using on-the-fly generated certificates. This means that data is transferred over an encrypted connection but there is no protection against a man in the middle yet.

With this issue we want to:

• make server and client certificates configurable
• optionally validate the client certificate
• optionally only allow matching subjects in client and server certificates

Issue Links

• relates to: OAK-9589 Backport OAK-9451 to oak-1.8
• links to: GitHub Pull Request #297
• links to: GitHub Pull Request #320
• links to: GitHub Pull Request #434
• links to: GitHub Pull Request #435