You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by GitBox <gi...@apache.org> on 2020/10/01 22:08:11 UTC
[GitHub] [hadoop-ozone] xiaoyuyao opened a new pull request #1468: HDDS-4301. SCM CA certificate does not encode KeyUsage extension prop…
xiaoyuyao opened a new pull request #1468:
URL: https://github.com/apache/hadoop-ozone/pull/1468
…ertly.
## What changes were proposed in this pull request?
Fix the encoding of KeyUsage in the CSR to ensure it can be used in FIPS environment.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-4301
## How was this patch tested?
FIPS enabled secure ozone cluster and verify that the CA certificate can be properly generated and used.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: ozone-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: ozone-issues-help@hadoop.apache.org
[GitHub] [hadoop-ozone] xiaoyuyao commented on pull request #1468: HDDS-4301. SCM CA certificate does not encode KeyUsage extension properly
Posted by GitBox <gi...@apache.org>.
xiaoyuyao commented on pull request #1468:
URL: https://github.com/apache/hadoop-ozone/pull/1468#issuecomment-706258012
bq. Is it a backward compatible change? If I understood well both the old method and new method is good enough for validation, but the new version is more standard.
Yes. The new version is the standard way to encode the keyUsage.
bq. There is a new DEROctetString(keyUsage) call in SelfSignedCertificate which is very similar to the one which is replaced in CertificateSigningRequest.
There are 4 "new DEROctetString" but only two of them are for keyUsage. This PR is to fix the encoding of the keyUsage. I don't see find issue of using DEROctetString for for constraints and subject alternate names extension.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: ozone-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: ozone-issues-help@hadoop.apache.org
[GitHub] [hadoop-ozone] xiaoyuyao merged pull request #1468: HDDS-4301. SCM CA certificate does not encode KeyUsage extension properly
Posted by GitBox <gi...@apache.org>.
xiaoyuyao merged pull request #1468:
URL: https://github.com/apache/hadoop-ozone/pull/1468
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: ozone-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: ozone-issues-help@hadoop.apache.org
[GitHub] [hadoop-ozone] xiaoyuyao commented on pull request #1468: HDDS-4301. SCM CA certificate does not encode KeyUsage extension properly
Posted by GitBox <gi...@apache.org>.
xiaoyuyao commented on pull request #1468:
URL: https://github.com/apache/hadoop-ozone/pull/1468#issuecomment-712413712
Thanks @elek and @arp7 for the review.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: ozone-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: ozone-issues-help@hadoop.apache.org