Improvement: Enable secure SSL certificate and hostname verification for internal traffic
- 主要语言
- Java
- 星标
- 3.1k
- 派生
- 1.4k
- 平均合并
- 6 天 19 小时
- 30 天内合并 PR
- 32
描述
### The required feature described as a wish
For internal traffic, it is common practice that HTTPS/TLS is used, but:
- the TLS certificates are often self-signed, or issued by an internal CA (not a public one like Let’s Encrypt).
- Sometimes services just use the server’s IP address instead of a DNS name.
Disabling SSL certificate and hostname verification increases compatibility, allowing CloudStack to interoperate with a wide range of hypervisors, networking equipment, and storage devices. This behavior is intentional by design, to ensure broader support across diverse environments. For example,
- Connect to Vmware vCenter
- Connect to Xenserver
- Connect to some external storage or network devices
We could provide more flexibility and also stronger security, including but not limited to
- Allow users to bring their own SSL certificates
- Support host name (DNS) instead of host ip in SSL communication
- Add an option for enforce SSL certificate verification
- Add an option for enforce hostname verification
贡献指南
调研方向
审查 VMware vCenter、Xenserver 以及外部存储或网络设备所使用的现有 SSL 连接路径;该 issue 未提供文件或测试入口。定义证书和主机名验证选项,包括支持用户提供的证书,并在考虑完成工作之前覆盖每个集成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- java
- 领域
- cloud, infrastructure, security
- Issue 类型
- 功能
- 难度
- 5/5
- 预计耗时
- 一周以上
- 活跃度
- 冷清
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100