[jira] [Resolved] (CASSANDRA-7848) Additional keystore configurations for SSL with HSMs

["Aleksey Yeschenko (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CASSANDRA-7848?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Aleksey Yeschenko resolved CASSANDRA-7848.
------------------------------------------
    Resolution: Not A Problem

bq. Patch to be submitted soon. Comments are welcome in the meantime.

It's been a long time now without a follow up. Are you still interested in providing a patch? If so and when so, feel free to reopen. Thanks!

> Additional keystore configurations for SSL with HSMs
> ----------------------------------------------------
>
>                 Key: CASSANDRA-7848
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-7848
>             Project: Cassandra
>          Issue Type: Improvement
>          Components: Configuration
>            Reporter: Hendrik van Huyssteen
>            Priority: Minor
>
> In order to use Cassandra with a Hardware Security Module (HSM) for encrypted communications, additional configuration options are required in terms of keystore configurations. 
> A user configuring Cassandra must be able to:
> # Specify the truststore and keystore type independently (eg. keystore would be in hardware and truststore in software)
> # Specify the desired certificate and private key entry that should be used, by setting an alias
> # Specify the keystore and keypair passwords independently
>  
> At the moment Cassandra only allows:
> # A global keystore type
> # Expects one keypair per keystore and
> # Uses the same password for the keystore and keypair
>  
> The appropriate changes have been made to Cassandra 1.2 to support the above mentioned configuration.
> The proposed cassandra.yaml would then look as follows, with the new changes marked with *:
> {noformat}
> server_encryption_options:
>     internode_encryption: all
>     keystore: <path to keystore>
>     keystore_password: <password of keystore>
>     store_type: <hsm storetype>
>     *keystore_entry_alias: <alias of key entry in keystore to use>*
>     *keystore_entry_password: <password of key entry in keystore to use>*
>  
>     truststore: <path to truststore>
>     truststore_password: <password of truststore>
>     # More advanced defaults below:
>     # protocol: TLS
>     *truststore_type: JKS*
>     # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]
> {noformat}
>  
> In terms of backwards compatibility, the following defaults should be used for the newly proposed settings:
> * truststore_type = store_type;
> * keystore_entry_password = keystore_password;
> * keystore_entry_alias = autoselect
> Example use case with HSM:
> * Keystore is stored in HSM.
> * store_type is set to the HSM store type.
> * keystore_password is set to the slot password of the HSM.
> * keystore_entry_password set to the keypair password.
> * Truststore is stored on disk, with type set to JKS. 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)