You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Attila Doroszlai (Jira)" <ji...@apache.org> on 2026/08/05 12:02:00 UTC
[jira] [Resolved] (HDDS-16034) Certificates omit DNS SANs on clusters with non-public hostname suffixes
[ https://issues.apache.org/jira/browse/HDDS-16034?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Attila Doroszlai resolved HDDS-16034.
-------------------------------------
Fix Version/s: 2.3.0
Resolution: Fixed
> Certificates omit DNS SANs on clusters with non-public hostname suffixes
> ------------------------------------------------------------------------
>
> Key: HDDS-16034
> URL: https://issues.apache.org/jira/browse/HDDS-16034
> Project: Apache Ozone
> Issue Type: Bug
> Components: Security
> Affects Versions: 2.1.1
> Reporter: Sergey Soldatov
> Assignee: Sergey Soldatov
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.3.0
>
>
> Ozone decides whether a hostname may appear as a dNSName Subject Alternative Name by calling commons-validator's DomainValidator, which enforces the IANA public TLD list. On clusters whose hosts use an internal suffix or a single-label name (scm1.lxd, om.internal, datanode1) that check fails everywhere. The CSR and self-signed-certificate builders silently drop every DNS SAN and continue, producing IP-only certificates that fail TLS hostname verification for by-name connections. The CA's DefaultProfile rejects any CSR that does carry such a name, so a node requesting one cannot be certified at all, blocking secure bootstrap.
> Suggested fix: replace the public-suffix test with an RFC 1123 hostname syntax check in a shared helper, applied symmetrically by both builders and by the CA. Internal suffixes and single-label names become legal; malformed, wildcard, and IP-literal values stay rejected. No new configuration key and no wire change. Certificates on public-suffix clusters are unchanged and need no reissue.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org