You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kafka.apache.org by ij...@apache.org on 2017/06/12 21:44:12 UTC
kafka git commit: MINOR: Specify keyalg RSA for SSL key generation
commands
Repository: kafka
Updated Branches:
refs/heads/trunk 2d154420c -> d06a0db8b
MINOR: Specify keyalg RSA for SSL key generation commands
Author: Manikumar Reddy O <ma...@gmail.com>
Reviewers: Ismael Juma <is...@juma.me.uk>
Closes #3305 from omkreddy/ssl-doc
Project: http://git-wip-us.apache.org/repos/asf/kafka/repo
Commit: http://git-wip-us.apache.org/repos/asf/kafka/commit/d06a0db8
Tree: http://git-wip-us.apache.org/repos/asf/kafka/tree/d06a0db8
Diff: http://git-wip-us.apache.org/repos/asf/kafka/diff/d06a0db8
Branch: refs/heads/trunk
Commit: d06a0db8b8fcd8ddbdf277885204a062a642dd67
Parents: 2d15442
Author: Manikumar Reddy O <ma...@gmail.com>
Authored: Mon Jun 12 22:43:58 2017 +0100
Committer: Ismael Juma <is...@juma.me.uk>
Committed: Mon Jun 12 22:43:58 2017 +0100
----------------------------------------------------------------------
docs/security.html | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/kafka/blob/d06a0db8/docs/security.html
----------------------------------------------------------------------
diff --git a/docs/security.html b/docs/security.html
index 09a6c33..5e2b202 100644
--- a/docs/security.html
+++ b/docs/security.html
@@ -43,7 +43,7 @@
The first step of deploying HTTPS is to generate the key and the certificate for each machine in the cluster. You can use Java's keytool utility to accomplish this task.
We will generate the key into a temporary keystore initially so that we can export and sign it later with CA.
<pre class="brush: bash;">
- keytool -keystore server.keystore.jks -alias localhost -validity {validity} -genkey</pre>
+ keytool -keystore server.keystore.jks -alias localhost -validity {validity} -genkey -keyalg RSA</pre>
You need to specify two parameters in the above command:
<ol>
@@ -63,7 +63,7 @@
<br>
Both fields are valid, RFC-2818 recommends the use of SAN however. SAN is also more flexible, allowing for multiple DNS entries to be declared. Another advantage is that the CN can be set to a more meaningful value for authorization purposes. To add a SAN field append the following argument <code> -ext SAN=DNS:{FQDN} </code> to the keytool command:
<pre class="brush: bash;">
- keytool -keystore server.keystore.jks -alias localhost -validity {validity} -genkey -ext SAN=DNS:{FQDN}
+ keytool -keystore server.keystore.jks -alias localhost -validity {validity} -genkey -keyalg RSA -ext SAN=DNS:{FQDN}
</pre>
The following command can be run afterwards to verify the contents of the generated certificate:
<pre class="brush: bash;">