You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@zookeeper.apache.org by GitBox <gi...@apache.org> on 2020/10/06 09:31:29 UTC
[GitHub] [zookeeper] symat opened a new pull request #1482: ZOOKEEPER-3950: Add support for BCFKS key/trust store format
symat opened a new pull request #1482:
URL: https://github.com/apache/zookeeper/pull/1482
This PR is the same as #1480 on the master branch, only the unit tests needed to be changed back from junit5 to junit4.
The BCFKS key store format is widely used in the industry, as it provides an open source alternative if someone has to use FIPS compliant key stores due to some regulatory constraints.
Currently in the ZooKeeper java client, only PEM, JKS and PEM12 is supported. I extend the list of supported key store formats with BCFKS.
I also tested this patch on a real FIPS compliant cluster, having the appropriate java security configs, security providers and also running a RedHat-based Linux distro (Centos 7.8) with FIPS mode enabled.
I tested both the client and the quorum SSL too. If someone wants to test this patch, and the keystore/truststore file names are not ending with ".bckfs", then (beside the usual SSL configs) make sure to also set the following parameters in the zoo.cfg:
```
ssl.keyStore.type=bcfks
ssl.trustStore.type=bcfks
ssl.quorum.keyStore.type=bcfks
ssl.quorum.trustStore.type=bcfks
```
and also provide the following parameters for the command line java client:
```
-Dzookeeper.ssl.keyStore.type=bcfks -Dzookeeper.ssl.trustStore.type=bcfks
```
This patch doesn't contain any modification for the c-client (that can be handled with a separate Jira, but I don't plan to work on that part right now).
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] symat commented on pull request #1482: ZOOKEEPER-3950: Add support for BCFKS key/trust store format
Posted by GitBox <gi...@apache.org>.
symat commented on pull request #1482:
URL: https://github.com/apache/zookeeper/pull/1482#issuecomment-704220339
thanks for checking, I'm going to merge it (the tests locally and on CI passed as well)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] symat closed pull request #1482: ZOOKEEPER-3950: Add support for BCFKS key/trust store format
Posted by GitBox <gi...@apache.org>.
symat closed pull request #1482:
URL: https://github.com/apache/zookeeper/pull/1482
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org