apache / apache/cloudstack

Improvement: Enable secure SSL certificate and hostname verification for internal traffic

Open
#11,699 2 comments 1 reaction 0 assignees View on GitHub
long-term-plan type:improvement type:security
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

### The required feature described as a wish

For internal traffic, it is common practice that HTTPS/TLS is used, but:
- the TLS certificates are often self-signed, or issued by an internal CA (not a public one like Let’s Encrypt).
- Sometimes services just use the server’s IP address instead of a DNS name.

Disabling SSL certificate and hostname verification increases compatibility, allowing CloudStack to interoperate with a wide range of hypervisors, networking equipment, and storage devices. This behavior is intentional by design, to ensure broader support across diverse environments. For example,
- Connect to Vmware vCenter
- Connect to Xenserver
- Connect to some external storage or network devices

We could provide more flexibility and also stronger security, including but not limited to

- Allow users to bring their own SSL certificates
- Support host name (DNS) instead of host ip in SSL communication
- Add an option for enforce SSL certificate verification
- Add an option for enforce hostname verification

Contributor guide

Open the contributing guide

Research direction

Review the existing SSL connection paths used for VMware vCenter, Xenserver, and external storage or network devices; the issue provides no file or test entry point. Define the certificate and hostname verification options, including support for user-supplied certificates, and cover each integration before considering the work done.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cloud, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.