From 81013c8a643fcca0a84f4efe0b2b65fffed176b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1vid=20Paksy?= Date: Wed, 2 Sep 2026 14:07:30 +0200 Subject: [PATCH] PHOENIX-7976: Introduce new parameters to support single-purpose Extended Key Usage (EKU) certificates To maintain compatibility assume that the current parameters are still Dual-purpose EKU certs and introduce new parameters. Fall back to the old parameters if the new one is not available. Current params: "phoenix.queryserver.tls.keystore"; "phoenix.queryserver.tls.truststore.password"; "phoenix.queryserver.tls.keystore.password"; "phoenix.queryserver.tls.truststore"; New proposed parameters: "phoenix.queryserver.tls.server.keystore"; "phoenix.queryserver.tls.server.keystore.password"; "phoenix.queryserver.tls.server.truststore"; "phoenix.queryserver.tls.server.truststore.password"; --- .../end2end/QueryServerEnvironment.java | 8 +++---- .../queryserver/QueryServerProperties.java | 8 +++++++ .../queryserver/server/QueryServer.java | 24 +++++++++++++++---- 3 files changed, 32 insertions(+), 8 deletions(-) diff --git a/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java b/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java index 8e5b068..b986c80 100644 --- a/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java +++ b/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java @@ -236,13 +236,13 @@ public QueryServerEnvironment(final Configuration confIn, int numberOfUsers, boo if (tls) { conf.setBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED, true); - conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE, + conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE, TlsUtil.getKeyStoreFile().getAbsolutePath()); - conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD, + conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE_PASSWORD, TlsUtil.getKeyStorePassword()); - conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE, + conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE, TlsUtil.getTrustStoreFile().getAbsolutePath()); - conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD, + conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE_PASSWORD, TlsUtil.getTrustStorePassword()); } diff --git a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java index 3b23e20..21cae81 100644 --- a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java +++ b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java @@ -66,12 +66,20 @@ public class QueryServerProperties { "phoenix.queryserver.tls.enabled"; public static final String QUERY_SERVER_TLS_KEYSTORE = "phoenix.queryserver.tls.keystore"; + public static final String QUERY_SERVER_TLS_SERVER_KEYSTORE = + "phoenix.queryserver.tls.server.keystore"; public static final String QUERY_SERVER_TLS_KEYSTORE_PASSWORD = "phoenix.queryserver.tls.keystore.password"; + public static final String QUERY_SERVER_TLS_SERVER_KEYSTORE_PASSWORD = + "phoenix.queryserver.tls.server.keystore.password"; public static final String QUERY_SERVER_TLS_TRUSTSTORE = "phoenix.queryserver.tls.truststore"; + public static final String QUERY_SERVER_TLS_SERVER_TRUSTSTORE = + "phoenix.queryserver.tls.server.truststore"; public static final String QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD = "phoenix.queryserver.tls.truststore.password"; + public static final String QUERY_SERVER_TLS_SERVER_TRUSTSTORE_PASSWORD = + "phoenix.queryserver.tls.server.truststore.password"; public static final String QUERY_SERVER_TLS_ENABLED_PROTCOLS = "phoenix.queryserver.tls.protocols"; public static final String QUERY_SERVER_TLS_ENABLED_CIPHERSUITES = diff --git a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java index de5ef58..7120b67 100644 --- a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java +++ b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java @@ -283,12 +283,28 @@ public int run(String[] args) throws Exception { private void setTlsIfNeccessary(Builder builder, Configuration conf) throws Exception { final boolean useTls = getConf().getBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_ENABLED); if(useTls) { - final String tlsKeystore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE); final String keystoreType = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_TYPE_KEY, QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_TYPE_DEFAULT); - final String tlsKeystorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD); - final String tlsTruststore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE); - final String tlsTruststorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD); + String tlsKeystore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE); + if (tlsKeystore == null){ + tlsKeystore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE); + } + + String tlsKeystorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD); + if (tlsKeystorePassword == null || tlsKeystorePassword.equals(QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD)) { + tlsKeystorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD); + } + + String tlsTruststore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE); + if (tlsTruststore == null){ + tlsTruststore = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE); + } + + String tlsTruststorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD); + if (tlsTruststorePassword == null || tlsTruststorePassword.equals(QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD)) { + tlsTruststorePassword = getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD, QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD); + } + if(tlsKeystore == null) { throw new Exception(String.format("if %s is enabled, %s must be specfified" , QueryServerProperties.QUERY_SERVER_TLS_ENABLED, QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE)); }