1

I have a question regardless cassandra node-to-node ssl encryption.

Currently I test node-to-node ssl. I set up self-signed certs with CN test-node-1.example.com which is the same as FQDN of the cassandra node. After that I set up cassandra conf for ssl support, ran cassandra - and everything worked fine. But after that I changed CN to test-node-1.exmaple.local and generated certs with that domain name record. In this case CN is not the same as FQDN of the node. But cassandra still worked fine.

So the question - Does cassandra support CN and FQDN verification? I saw the option "require_endpoint_verification", but as I understood, it works with IP addresses in SAN field and not domain name records.

Probably you could clarify this for me, thanks!

1 Answer 1

2

I believe you are correct, if you are going to set require_endpoint_verification to true then the SAN must be an IP, it cannot be an FQDN. It's spelled out pretty well in the DSE docs, for reference: https://docs.datastax.com/en/dse68-security/docs/secInternodeSsl.html

On this page:

require_endpoint_verification: Whether to verify the connected host and the host IP address in the certificate match. If set to true, then the endpoint that you specify when generating the certificate key must be an IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.