Luca Kovacs created HBASE-30387:
-----------------------------------
Summary: Support SingleEKU certificates
Key: HBASE-30387
URL: https://issues.apache.org/jira/browse/HBASE-30387
Project: HBase
Issue Type: Improvement
Reporter: Luca Kovacs
Assignee: Luca Kovacs
h2. Motivation
HBase currently only supports dual-purpose certificates. These certificate
carry both the serverAuth and clientAuth Extended Key Usages (EKUs), meaning
the same key and certificate is used whether the service running on the host is
acting as a TLS server or as a client in a mutual-TLS (mTLS) handshake.
Industry standards and public CA-s (like DigiCert) are sunsetting multi-use
certificates, making the current requirement for dual serverAuth and clientAuth
EKUs difficult to manage.
h2. Goal
Allow configuring a separate client keystore and server truststore so that
single-EKU certificates work out of the box, while maintaining full backward
compatibility when only the existing keyStore.* properties are set.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
