[jira] [Created] (KNOX-3359) Support Single-Purpose EKU Certificates

["Sandeep More (Jira)" <ji...@apache.org>]

Sandeep More created KNOX-3359:
----------------------------------

             Summary: Support Single-Purpose EKU Certificates
                 Key: KNOX-3359
                 URL: https://issues.apache.org/jira/browse/KNOX-3359
             Project: Apache Knox
          Issue Type: New Feature
          Components: Server
            Reporter: Sandeep More
            Assignee: Sandeep More


h1. Background

Knox currently supports a single certificate per host. This certificate carries both the serverAuth and clientAuth Extended Key Usages (EKUs), meaning the same key and certificate is used whether the service running on the host is acting as a TLS server or as a client in a mutual-TLS (mTLS) handshake.
 
Industry standards and public CAs (like DigiCert) are sunsetting multi-use certificates, making Knox's current requirement for dual serverAuth and clientAuth EKUs difficult to manage.
h1. Overview:

Knox will need separate keystores and truststores for client authentication and server authentication.
 # Keystores:

 * 
 -- Knox to assert its identity as a server
 -- Knox to assert its identity as a client (to downstream services)

       2.Truststores:
 * 
 -- Clients asserting identity to Knox
 -- Servers asserting identity to Knox



--
This message was sent by Atlassian Jira
(v8.20.10#820010)