Mailing-List: contact commits-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cassandra.apache.org
Date: Wed, 6 Jan 2016 17:57:40 +0000 (UTC)
From: "Matthias Brandt (JIRA)" <jira@apache.org>
To: commits@cassandra.apache.org
Message-ID: <JIRA.12927972.1452073594000.35344.1452103060048@Atlassian.JIRA>
In-Reply-To: <JIRA.12927972.1452073594000@Atlassian.JIRA>
References: <JIRA.12927972.1452073594000@Atlassian.JIRA>
 <JIRA.12927972.1452073594805@arcas>
Subject: [jira] [Commented] (CASSANDRA-10970) SSL/TLS: Certificate Domain is
 ignored
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/CASSANDRA-10970?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15085945#comment-15085945 ] 

Matthias Brandt commented on CASSANDRA-10970:
---------------------------------------------

{quote}Are you saying the system hostname of the server(s) is some other domain?{quote}
Not only the hostname is different, it's a complete different server. In my current setup, I'm connecting against node1.my.other-domain.com, which responds with a certificate for *.my.domain.com. 

Just forgot to say: This issue belongs to cqlsh.
Just found out that this also was in issue in the java driver from datastax in versions < 3.x: https://datastax-oss.atlassian.net/browse/JAVA-716

> SSL/TLS: Certificate Domain is ignored
> --------------------------------------
>
>                 Key: CASSANDRA-10970
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-10970
>             Project: Cassandra
>          Issue Type: Bug
>            Reporter: Matthias Brandt
>
> I've set up server_encryption_options as well as client_encryption_options. In both settings, I use the same keystore with an wild-card SSL certificate in it. It is signed by our own CA, which root certificate is in the configured truststore:
> {code}
> server_encryption_options:
>     internode_encryption: all
>     keystore: /etc/cassandra/conf/wildcard-cert.keystore
>     keystore_password: ""
>     truststore: /etc/cassandra/conf/my-cacerts
>     truststore_password: changeit
>     require_client_auth: true
> client_encryption_options:
>     enabled: true
>     keystore: /etc/cassandra/conf/wildcard-cert.keystore
>     keystore_password: ""
>     require_client_auth: false
> {code}
> The certifcate's subject is:
> {code}CN=*.my.domain.com,OU=my unit,O=my org{code}
> When I deploy this setting on a server which domain is node1.my.*other-domain*.com a connection via cqlsh wrongly works. Additionally, the inter-node connection between other nodes in this wrong domain also works.
> I would expect that the connection would fail with a meaningful error message.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)