[jira] [Updated] (FLINK-37764) Add support for configurable custom TrustManagerFactory in SSLUtils

["Purshotam Shah (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/FLINK-37764?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Purshotam Shah updated FLINK-37764:
-----------------------------------
    Description: 
Thought for a couple of seconds

*Jira Description*

*Background*
Currently, SSLUtils only supports the built-in FingerprintTrustManagerFactory or the default JDK TrustManagerFactory. We need to allow users to plug in their own {{TrustManagerFactory}} implementation—so they can load a custom truststore, perform additional (in our case, enforce specific CN-name validation)

*Requirements*
 # Introduce a new config option:

{{security.ssl.trustmanager.factory.class}}
– Type: {{String}} (fully-qualified class name)
– No default value (optional)
– When set, Flink must:

 ** Instantiate this class via its no-arg constructor

 ** Call {{init(trustStore)}} on it, passing in the configured keystore

 ** Use it in place of the built-in fingerprint/Athenz/default logic

 # The user’s custom class *must* extend {{javax.net.ssl.TrustManagerFactory}} and in its implementation:

 ** Load the configured truststore

 ** Perform any custom SSL certificate verification

 ** Enforce CN-name checks to ensure only the specified Common Names are accepted

 # Fallback behavior when the option is *not* set:

 ** If {{ssl.*.cert-fingerprint}} is configured → use {{FingerprintTrustManagerFactory}}

 ** Else → use the JVM’s default {{TrustManagerFactory}}

> Add support for configurable custom TrustManagerFactory in SSLUtils
> -------------------------------------------------------------------
>
>                 Key: FLINK-37764
>                 URL: https://issues.apache.org/jira/browse/FLINK-37764
>             Project: Flink
>          Issue Type: Improvement
>            Reporter: Purshotam Shah
>            Priority: Major
>
> Thought for a couple of seconds
> *Jira Description*
> *Background*
> Currently, SSLUtils only supports the built-in FingerprintTrustManagerFactory or the default JDK TrustManagerFactory. We need to allow users to plug in their own {{TrustManagerFactory}} implementation—so they can load a custom truststore, perform additional (in our case, enforce specific CN-name validation)
> *Requirements*
>  # Introduce a new config option:
> {{security.ssl.trustmanager.factory.class}}
> – Type: {{String}} (fully-qualified class name)
> – No default value (optional)
> – When set, Flink must:
>  ** Instantiate this class via its no-arg constructor
>  ** Call {{init(trustStore)}} on it, passing in the configured keystore
>  ** Use it in place of the built-in fingerprint/Athenz/default logic
>  # The user’s custom class *must* extend {{javax.net.ssl.TrustManagerFactory}} and in its implementation:
>  ** Load the configured truststore
>  ** Perform any custom SSL certificate verification
>  ** Enforce CN-name checks to ensure only the specified Common Names are accepted
>  # Fallback behavior when the option is *not* set:
>  ** If {{ssl.*.cert-fingerprint}} is configured → use {{FingerprintTrustManagerFactory}}
>  ** Else → use the JVM’s default {{TrustManagerFactory}}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)