[MXS-4950] Support client side ephemeral certificates Created: 2024-01-22  Updated: 2024-02-06

Status: Open
Project: MariaDB MaxScale
Component/s: mariadbclient
Affects Version/s: 24.02.0
Fix Version/s: None

Type: New Feature Priority: Major
Reporter: Esa Korhonen Assignee: Esa Korhonen
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Blocks
blocks MXS-4774 Add support for ephemeral server cert... In Progress

 Description   

Add support for sending ephemeral certificate fingerprint digest to client. More details in https://mariadb.org/mission-impossible-zero-configuration-ssl

If a MaxScale listener has `ssl=1` but both `ssl_key` and `ssl_cert` are unset, MaxScale should generate the key and certificate during startup and keep it stored in memory. The certificate is used when communicating with clients. If client accepts the certificate (no clients currently support this) and sends correct password, MaxScale then sends a hash of the password and certificate to the client to prove that it knows the client's password hash. If client password is empty, MaxScale should not send the hash.


Generated at Thu Feb 08 04:32:19 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.