You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@spark.apache.org by "Tim Meehan (Jira)" <ji...@apache.org> on 2026/09/02 17:01:00 UTC

[jira] [Created] (SPARK-59181) Use system default trust managers when the RPC truststore is missing

Tim Meehan created SPARK-59181:
----------------------------------

             Summary: Use system default trust managers when the RPC truststore is missing
                 Key: SPARK-59181
                 URL: https://issues.apache.org/jira/browse/SPARK-59181
             Project: Spark
          Issue Type: Bug
          Components: Input/Output
    Affects Versions: 4.2.0
            Reporter: Tim Meehan


Spark RPC TLS currently falls back to trusting all certificates when no usable truststore is configured. This silently disables peer authentication and permits man-in-the-middle attacks.

Use the JVM’s default TrustManagerFactory when no explicit truststore is available. Operators using self-signed certificates or internal CAs must configure a Spark truststore or add the CA to the JVM default truststore.

Pull request: https://github.com/apache/spark/pull/58478



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org