[ https://issues.apache.org/jira/browse/BOOKKEEPER-588?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15706555#comment-15706555 ]
Kishore Kasi Udayashankar commented on BOOKKEEPER-588: ------------------------------------------------------ Enrico, Sorry for the delay in my response. 2. Both client and bookkeeper server would require path to trustStore and keyStore along with their password files. Keeping these as sys properties will make the deployment scripts easier to provide appropriate path for the setup it is used in. This is modeled after zookeeper. I have one more concern of going the StartTLS route - From RFC I read: A man-in-the-middle attack can be launched by deleting the "250 STARTTLS" response from the server. This would cause the client not to try to start a TLS session. Another man-in-the-middle attack is to allow the server to announce its STARTTLS capability, but to alter the client's request to start TLS and the server's response. In order to defend against such attacks both clients and servers MUST be able to be configured to require successful TLS negotiation of an appropriate cipher suite for selected hosts before messages can be successfully transferred. The additional option of using TLS when possible SHOULD also be provided. An implementation MAY provide the ability to record that TLS was used in communicating with a given peer and generating a warning if it is not used in a later session. Have to thought more about it? > SSL support > ----------- > > Key: BOOKKEEPER-588 > URL: https://issues.apache.org/jira/browse/BOOKKEEPER-588 > Project: Bookkeeper > Issue Type: Sub-task > Reporter: Ivan Kelly > Assignee: Enrico Olivelli > Fix For: 4.5.0 > > Attachments: 0001-MutualTLS-for-Bookkeeper.patch, > 0004-BOOKKEEPER-588-SSL-support-for-bookkeeper.patch > > > SSL support using startTLS -- This message was sent by Atlassian JIRA (v6.3.4#6332)