Improvement: Enable secure SSL certificate and hostname verification for internal traffic
- 主要語言
- Java
- 星號
- 3.1k
- 分支
- 1.4k
- 平均合併
- 6 天 19 小時
- 30 天內合併 PR
- 32
描述
### The required feature described as a wish
For internal traffic, it is common practice that HTTPS/TLS is used, but:
- the TLS certificates are often self-signed, or issued by an internal CA (not a public one like Let’s Encrypt).
- Sometimes services just use the server’s IP address instead of a DNS name.
Disabling SSL certificate and hostname verification increases compatibility, allowing CloudStack to interoperate with a wide range of hypervisors, networking equipment, and storage devices. This behavior is intentional by design, to ensure broader support across diverse environments. For example,
- Connect to Vmware vCenter
- Connect to Xenserver
- Connect to some external storage or network devices
We could provide more flexibility and also stronger security, including but not limited to
- Allow users to bring their own SSL certificates
- Support host name (DNS) instead of host ip in SSL communication
- Add an option for enforce SSL certificate verification
- Add an option for enforce hostname verification
貢獻指南
研究方向
檢視 VMware vCenter、Xenserver 以及外部儲存或網路裝置所使用的現有 SSL 連線路徑;該 issue 未提供檔案或測試入口。定義憑證與主機名稱驗證選項,包括支援使用者提供的憑證,並在考慮完成工作之前涵蓋每個整合。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- java
- 領域
- cloud, infrastructure, security
- Issue 類型
- 功能
- 難度
- 5/5
- 預估耗時
- 一週以上
- 活躍度
- 冷清
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100