apache / apache/cloudstack

Improvement: Enable secure SSL certificate and hostname verification for internal traffic

未关闭
#11,699 2 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看
long-term-plan type:improvement type:security
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

### The required feature described as a wish

For internal traffic, it is common practice that HTTPS/TLS is used, but:
- the TLS certificates are often self-signed, or issued by an internal CA (not a public one like Let’s Encrypt).
- Sometimes services just use the server’s IP address instead of a DNS name.

Disabling SSL certificate and hostname verification increases compatibility, allowing CloudStack to interoperate with a wide range of hypervisors, networking equipment, and storage devices. This behavior is intentional by design, to ensure broader support across diverse environments. For example,
- Connect to Vmware vCenter
- Connect to Xenserver
- Connect to some external storage or network devices

We could provide more flexibility and also stronger security, including but not limited to

- Allow users to bring their own SSL certificates
- Support host name (DNS) instead of host ip in SSL communication
- Add an option for enforce SSL certificate verification
- Add an option for enforce hostname verification

贡献指南

打开贡献指南

调研方向

审查 VMware vCenter、Xenserver 以及外部存储或网络设备所使用的现有 SSL 连接路径;该 issue 未提供文件或测试入口。定义证书和主机名验证选项,包括支持用户提供的证书,并在考虑完成工作之前覆盖每个集成。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
cloud, infrastructure, security
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
冷清
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。