You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Prashant Pogde (Jira)" <ji...@apache.org> on 2021/01/20 19:17:00 UTC
[jira] [Comment Edited] (HDDS-2731) Certification Revocation
Support for Ozone CA
[ https://issues.apache.org/jira/browse/HDDS-2731?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17268790#comment-17268790 ]
Prashant Pogde edited comment on HDDS-2731 at 1/20/21, 7:16 PM:
----------------------------------------------------------------
[~elek] I am setting the target as 1.1.0 release. Please let me know if this needs to be moved out of 1.1.0 scope.
was (Author: ppogde):
Setting the target as 1.1.0 release. Please let us know if this needs to be moved out of 1.1.0 scope.
> Certification Revocation Support for Ozone CA
> ---------------------------------------------
>
> Key: HDDS-2731
> URL: https://issues.apache.org/jira/browse/HDDS-2731
> Project: Hadoop Distributed Data Store
> Issue Type: Improvement
> Reporter: Marton Elek
> Assignee: Xiaoyu Yao
> Priority: Major
> Fix For: 1.1.0
>
> Attachments: Certificate Revocation Support for Ozone CA.rtf, Ozone SCM CA Key_Certificate Rotation - HDDS-2731.pdf
>
>
> Currently, in Ozone, communication between Ozone Manager, SCM and Data Nodes takes place over TLS protocol, which is, through issued security artifacts i.e. [X509 certificates|https://en.wikipedia.org/wiki/X.509]. These certificates reside at SCM storage. The “known and trusted” data nodes are provisioned with corresponding certificates and for smooth communication in the system, these certificates are also stored on client certificate cache.
> Problem is, once these certificates are invalidated on SCM, whether its Admin or Expired Certs or Cert Rotation Process (future), these certs are not removed or invalidated on Data Node’s Local Cache. This means that tokens issues by Ozone Manager (OM), can still be used to access blocks from Data Nodes since the client certificate case still holds the invalidated certificate.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org