apache / apache/cloudstack

Improvement: Enable secure SSL certificate and hostname verification for internal traffic

未關閉
#11,699 2 則留言 1 個 reaction 已指派 0 人 在 GitHub 檢視
long-term-plan type:improvement type:security
主要語言
Java
星號
3.1k
分支
1.4k
平均合併
6 天 19 小時
30 天內合併 PR
32

描述

### The required feature described as a wish

For internal traffic, it is common practice that HTTPS/TLS is used, but:
- the TLS certificates are often self-signed, or issued by an internal CA (not a public one like Let’s Encrypt).
- Sometimes services just use the server’s IP address instead of a DNS name.

Disabling SSL certificate and hostname verification increases compatibility, allowing CloudStack to interoperate with a wide range of hypervisors, networking equipment, and storage devices. This behavior is intentional by design, to ensure broader support across diverse environments. For example,
- Connect to Vmware vCenter
- Connect to Xenserver
- Connect to some external storage or network devices

We could provide more flexibility and also stronger security, including but not limited to

- Allow users to bring their own SSL certificates
- Support host name (DNS) instead of host ip in SSL communication
- Add an option for enforce SSL certificate verification
- Add an option for enforce hostname verification

貢獻指南

開啟貢獻指南

研究方向

檢視 VMware vCenter、Xenserver 以及外部儲存或網路裝置所使用的現有 SSL 連線路徑;該 issue 未提供檔案或測試入口。定義憑證與主機名稱驗證選項,包括支援使用者提供的憑證,並在考慮完成工作之前涵蓋每個整合。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
cloud, infrastructure, security
Issue 類型
功能
難度
5/5
預估耗時
一週以上
活躍度
冷清
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。