Graylog2 / Graylog2/graylog2-server
Email transport needs TLS trust settings
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 218
Description
Each in- or outbound connection that supports TLS needs a full complement of setttings to be specified, particularly the certificates that are to be trusted. The CA I trust for our elasticsearch cluser is not necessarily the same as for e.g. SMTP servers.
## Expected Behavior
For each kind of system-level in- or outbound connection (https, elasticsearch back-end, email, etc.), it must be possible to specify different truststores or trusted certificate files.
## Current Behavior
The system-wide truststore is used for all connections, which is not desirable and in fact significantly weakens protection, particularly on the elasticsearch and mongodb back-end connections.
## Context
There are serious issues with the way certificate trust is implemented. As it seems, the only way to configure trusted certificates is to use a system-wide truststore, defined at startup. This is a major concern since the certificates presented by our elasticsearch cluster (for example) are internal only, and we specifically do not want to trust anything else for those connections. The problem rears its head when trying to configure SSL or TLS for email; the same truststore is being used but the email server is presenting a commercially-issued certificate, which is not in the truststore. In addition, creating the dependency of having to modify the truststore whenever the email server changes certificate authority _will_ cause outages, and one is not necessarily notified when this happens.
In other words: For each purpose, a separate truststore setting is needed - much like each input can have its own TLS certificate and trusted certificates specified.
## Your Environment
* Graylog Version: 3.1.3
* Operating System: FreeBSD 12.1
Contributor guide
Research direction
Start by tracing how the system-wide truststore is initialized and how TLS is configured for email, Elasticsearch, MongoDB, and HTTPS connections. Done means each connection type can specify its own truststore or trusted certificate files without relying on the shared truststore.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch, java, mongodb
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100