Uploaded image for project: 'MariaDB ColumnStore'
  1. MariaDB ColumnStore
  2. MCOL-3542

Add option to not verify an SSL certificate

Details

    • Task
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 1.4.0
    • 5.6.1
    • None
    • None

    Description

      Low hanging fruit.

      We gave the 1.2.5 + S3 package to Patrice @ ABS (iirc?) to play with. It is not working for him b/c the S3 boxes he's using (some on-prem WD boxes that impl S3 protocol) have SSL certs that can't be verified.

      Using the libmarias3 lib directly and setting S3NOVERIFY=1, he can interact with it. SM doesn't currently have the option to do that, but should have one. Just needs to know to init the S3 lib with that var or not, don't have to implement anything substantial.

      Attachments

        Activity

          Ascending order - Click to sort in descending order
          pleblanc Patrick LeBlanc (Inactive) created issue -
          pleblanc Patrick LeBlanc (Inactive) made changes -
          Field Original Value New Value
          Description Low hanging fruit.

          We gave the 1.2.5 + S3 package to Patrice @ ABS (iirc?) to play with. It is not working for him b/c the S3 boxes he's using (some on-prem WD boxes that impl S3 protocol) have SSL certs that can't be verified.

          Using the libmarias3 lib directly and setting S3NOVERIFY=1, he can interact with it. SM doesn't currently have the option to do that, but should have one. Just needs to know to init the S3 lib with that var or not, don't have to implement anyway substantial.           		Low hanging fruit.

          We gave the 1.2.5 + S3 package to Patrice @ ABS (iirc?) to play with. It is not working for him b/c the S3 boxes he's using (some on-prem WD boxes that impl S3 protocol) have SSL certs that can't be verified.

          Using the libmarias3 lib directly and setting S3NOVERIFY=1, he can interact with it. SM doesn't currently have the option to do that, but should have one. Just needs to know to init the S3 lib with that var or not, don't have to implement anything substantial.
          plinel patrice added a comment -

          the problem is not that the SSL cert can't be verified, it is the url construction that makes it not verifiable. constructing the url in the same way it is when using an IP would make it work. for reference : http://www.wryway.com/blog/aws-s3-url-styles/

          plinel patrice added a comment - the problem is not that the SSL cert can't be verified, it is the url construction that makes it not verifiable. constructing the url in the same way it is when using an IP would make it work. for reference : http://www.wryway.com/blog/aws-s3-url-styles/
          toddstoffel Todd Stoffel (Inactive) made changes -
          Assignee Ben Thompson [ ben.thompson ]
          toddstoffel Todd Stoffel (Inactive) made changes -
          Fix Version/s 5.6.1 [ 25031 ]
          ben.thompson Ben Thompson (Inactive) added a comment -

          Change should be made to storagemanager.cnf to support setting these option in libmarias3 via StorageManager
          SM_USE_HTTP (default disabled – current default is https)
          SM_SSL_VERIFY (default enabled)

          ben.thompson Ben Thompson (Inactive) added a comment - Change should be made to storagemanager.cnf to support setting these option in libmarias3 via StorageManager SM_USE_HTTP (default disabled – current default is https) SM_SSL_VERIFY (default enabled)
          gdorman Gregory Dorman (Inactive) made changes -
          Parent MCOL-3449 [ 78397 ]
          Issue Type Sub-Task [ 10000 ] Task [ 3 ]
          gdorman Gregory Dorman (Inactive) made changes -
          Epic Link MCOL-3548 [ 79545 ]
          gdorman Gregory Dorman (Inactive) made changes -
          Sprint 2021-5 [ 504 ]
          gdorman Gregory Dorman (Inactive) made changes -
          Rank Ranked higher
          toddstoffel Todd Stoffel (Inactive) made changes -
          Rank Ranked lower
          ben.thompson Ben Thompson (Inactive) made changes -
          Status Open [ 1 ] In Progress [ 3 ]
          ben.thompson Ben Thompson (Inactive) added a comment -

          cnf file options added:

          1. Setting use_http to 'enabled' for host to use http instead of https
          2. The default is use_http = disabled (https)
          3. use_http = enabled
          1. Setting ssl_verify to 'disabled' for how to not use SSL verification
          2. Default is ssl_verify = enabled
          3. ssl_verify = disabled
          ben.thompson Ben Thompson (Inactive) added a comment - cnf file options added: Setting use_http to 'enabled' for host to use http instead of https The default is use_http = disabled (https) use_http = enabled Setting ssl_verify to 'disabled' for how to not use SSL verification Default is ssl_verify = enabled ssl_verify = disabled
          ben.thompson Ben Thompson (Inactive) made changes -
          Assignee Ben Thompson [ ben.thompson ] David Hall [ david.hall ]
          Status In Progress [ 3 ] In Review [ 10002 ]
          David.Hall David Hall (Inactive) made changes -
          Status In Review [ 10002 ] In Testing [ 10301 ]
          David.Hall David Hall (Inactive) made changes -
          Assignee David Hall [ david.hall ] Daniel Lee [ dleeyh ]
          gdorman Gregory Dorman (Inactive) made changes -
          Sprint 2021-5 [ 504 ] 2021-5, 2021-6 [ 504, 509 ]
          dleeyh Daniel Lee (Inactive) made changes -
          Assignee Daniel Lee [ dleeyh ] Ben Thompson [ ben.thompson ]
          gdorman Gregory Dorman (Inactive) made changes -
          Sprint 2021-5, 2021-6 [ 504, 509 ] 2021-5, 2021-6, 2021-7 [ 504, 509, 514 ]
          gdorman Gregory Dorman (Inactive) made changes -
          Resolution Fixed [ 1 ]
          Status In Testing [ 10301 ] Closed [ 6 ]

          People

            ben.thompson Ben Thompson (Inactive)
            pleblanc Patrick LeBlanc (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.