[
https://issues.apache.org/jira/browse/KNOX-3359?focusedWorklogId=1028975&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1028975
]
ASF GitHub Bot logged work on KNOX-3359:
----------------------------------------
Author: ASF GitHub Bot
Created on: 09/Jul/26 18:15
Start Date: 09/Jul/26 18:15
Worklog Time Spent: 10m
Work Description: pzampino commented on code in PR #1291:
URL: https://github.com/apache/knox/pull/1291#discussion_r3553832043
##########
gateway-util-common/src/main/java/org/apache/knox/gateway/util/X509CertificateUtil.java:
##########
@@ -73,7 +76,7 @@ public class X509CertificateUtil {
* @param algorithm the signing algorithm, eg "SHA256withRSA"
* @return self-signed X.509 certificate
*/
- public static X509Certificate generateCertificate(String dn, KeyPair pair,
int days, String algorithm) {
+ public static X509Certificate generateCertificate(String dn, KeyPair pair,
int days, String algorithm, String... ekuOids) {
Review Comment:
We'll always generate single-EKU certs with this method now? Do we need to
maintain the previous signature of this method for any reason and ADD this one
instead?
##########
gateway-spi/src/main/java/org/apache/knox/gateway/dispatch/DefaultHttpClientFactory.java:
##########
@@ -201,6 +212,11 @@ SSLContext createSSLContext(GatewayServices services,
FilterConfig filterConfig,
trustKeystore = identityKeystore;
Review Comment:
Why is the truststore the same as the identity keystore? You're reusing the
the client truststore as the Knox identity keystore in the mTLS scenario?
##########
gateway-spi/src/main/java/org/apache/knox/gateway/services/security/KeystoreService.java:
##########
@@ -34,6 +34,15 @@ public interface KeystoreService extends Service {
void addSelfSignedCertForGateway(String alias, char[] passphrase, String
hostname) throws KeystoreServiceException;
+ /**
+ * Adds a self-signed certificate to the Gateway keystore, stamping the
given Extended Key Usage
+ * purpose OIDs (single-EKU identities). The default implementation ignores
the OIDs.
+ */
+ default void addSelfSignedCertForGateway(String alias, char[] passphrase,
String hostname, String... ekuOids)
Review Comment:
What is the purpose of this new method? Is it to support self-signed
single-EKU certs for Knox?
##########
gateway-spi/src/main/java/org/apache/knox/gateway/dispatch/DefaultHttpClientFactory.java:
##########
@@ -173,25 +173,36 @@ private boolean doesRetryParamExist(final FilterConfig
filterConfig) {
* <p>
* This method is package private to allow access to unit tests
*
- * @param services the {@link GatewayServices}
- * @param filterConfig a {@link FilterConfig} used to query for parameters
for this operation
- * @param serviceRole the name of the service role to whom this HTTP client
is being created for
+ * @param services the {@link GatewayServices}
+ * @param gatewayConfig the {@link GatewayConfig} used to determine
single-EKU mode
+ * @param filterConfig a {@link FilterConfig} used to query for parameters
for this operation
+ * @param serviceRole the name of the service role to whom this HTTP
client is being created for
* @return a {@link SSLContext} or <code>null</code> if a custom {@link
SSLContext} is not needed.
*/
- SSLContext createSSLContext(GatewayServices services, FilterConfig
filterConfig, String serviceRole) {
+ SSLContext createSSLContext(GatewayServices services, GatewayConfig
gatewayConfig, FilterConfig filterConfig, String serviceRole) {
KeyStore identityKeystore;
char[] identityKeyPassphrase;
KeyStore trustKeystore;
KeystoreService ks = services.getService(ServiceType.KEYSTORE_SERVICE);
try {
- if
(Boolean.parseBoolean(filterConfig.getInitParameter(PARAMETER_USE_TWO_WAY_SSL)))
{
+ boolean singleEku = gatewayConfig != null &&
gatewayConfig.isSingleEkuEnabled();
+ boolean twoWaySsl =
Boolean.parseBoolean(filterConfig.getInitParameter(PARAMETER_USE_TWO_WAY_SSL))
+ || (gatewayConfig != null &&
gatewayConfig.isHttpClientTwoWaySslEnabled());
Review Comment:
There is global config for mTLS for dispatching (i.e.,
gatewayConfig.isHttpClientTwoWaySslEnabled())?
Issue Time Tracking
-------------------
Worklog Id: (was: 1028975)
Time Spent: 2h (was: 1h 50m)
> Support Single-Purpose EKU Certificates
> ---------------------------------------
>
> Key: KNOX-3359
> URL: https://issues.apache.org/jira/browse/KNOX-3359
> Project: Apache Knox
> Issue Type: New Feature
> Components: Server
> Reporter: Sandeep More
> Assignee: Sandeep More
> Priority: Major
> Time Spent: 2h
> Remaining Estimate: 0h
>
> h1. Background
> Knox currently supports a single certificate per host. This certificate
> carries both the serverAuth and clientAuth Extended Key Usages (EKUs),
> meaning the same key and certificate is used whether the service running on
> the host is acting as a TLS server or as a client in a mutual-TLS (mTLS)
> handshake.
>
> Industry standards and public CAs (like DigiCert) are sunsetting multi-use
> certificates, making Knox's current requirement for dual serverAuth and
> clientAuth EKUs difficult to manage.
> h1. Overview:
> Knox will need separate keystores and truststores for client authentication
> and server authentication.
> # Keystores:
> *
> -- Knox to assert its identity as a server
> -- Knox to assert its identity as a client (to downstream services)
> 2.Truststores:
> *
> -- Clients asserting identity to Knox
> -- Servers asserting identity to Knox
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
