[jira] [Created] (IMPALA-6172) KRPC w/ TLS doesn't work on remote clusters after rebase

["Sailesh Mukil (JIRA)" <ji...@apache.org>]

Sailesh Mukil created IMPALA-6172:
-------------------------------------

             Summary: KRPC w/ TLS doesn't work on remote clusters after rebase
                 Key: IMPALA-6172
                 URL: https://issues.apache.org/jira/browse/IMPALA-6172
             Project: IMPALA
          Issue Type: Bug
          Components: Security
            Reporter: Sailesh Mukil
            Assignee: Sailesh Mukil
            Priority: Blocker


It looks like depending on who initializes OpenSSL (KRPC or us), the behavior changes. After some cherry-picks, we're unable to run Impala on remote clusters with TLS with certain certificate types.

We get the following when we use intermediate CAs:
{code:java}
"F1108 10:47:36.532202 93303 impalad-main.cc:79] Could not build messenger: Runtime error: certificate does not match private key: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:331"
{code}

And we get the following when we use self-signed certificates:
"self signed certificate in certificate chain"



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)