You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@hbase.apache.org by "Luca Kovacs (Jira)" <ji...@apache.org> on 2026/09/16 12:05:00 UTC

[jira] [Created] (HBASE-30387) Support SingleEKU certificates

Luca Kovacs created HBASE-30387:
-----------------------------------

             Summary: Support SingleEKU certificates
                 Key: HBASE-30387
                 URL: https://issues.apache.org/jira/browse/HBASE-30387
             Project: HBase
          Issue Type: Improvement
            Reporter: Luca Kovacs
            Assignee: Luca Kovacs


h2. Motivation

HBase currently only supports dual-purpose certificates. These certificate carry both the serverAuth and clientAuth Extended Key Usages (EKUs), meaning the same key and certificate is used whether the service running on the host is acting as a TLS server or as a client in a mutual-TLS (mTLS) handshake.

Industry standards and public CA-s (like DigiCert) are sunsetting multi-use certificates, making the current requirement for dual serverAuth and clientAuth EKUs difficult to manage.
h2. Goal

Allow configuring a separate client keystore and server truststore so that single-EKU certificates work out of the box, while maintaining full backward compatibility when only the existing keyStore.* properties are set.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)