natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'cassandra-2.1' into trunk

This commit is contained in:
Brandon Williams 2014-07-10 12:10:56 -05:00
parent bb2fdd0183 6cc03b9606
commit 0b89ae2601
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -26,6 +26,7 @@
* (Windows) fix startup when WMI memory query fails (CASSANDRA-7505)
* Anti-compaction proceeds if any part of the repair failed (CASANDRA-7521)
Merged from 2.0:
* Warn when SSL certificates have expired (CASSANDRA-7528)
* Fix error when doing reversed queries with static columns (CASSANDRA-7490)

19
src/java/org/apache/cassandra/security/SSLFactory.java
View File

@ -23,6 +23,9 @@ import java.io.IOException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import java.util.Date;
import java.util.Enumeration;
import java.util.Set;
import javax.net.ssl.KeyManagerFactory;
@ -48,6 +51,8 @@ public final class SSLFactory
{
private static final Logger logger = LoggerFactory.getLogger(SSLFactory.class);
private static boolean checkedExpiry = false;
public static SSLServerSocket getServerSocket(EncryptionOptions options, InetAddress address, int port) throws IOException
{
SSLContext ctx = createSSLContext(options, true);
@ -114,6 +119,20 @@ public final class SSLFactory
KeyManagerFactory kmf = KeyManagerFactory.getInstance(options.algorithm);
KeyStore ks = KeyStore.getInstance(options.store_type);
ks.load(ksf, options.keystore_password.toCharArray());
if (!checkedExpiry)
{
for (Enumeration<String> aliases = ks.aliases(); aliases.hasMoreElements(); )
{
String alias = aliases.nextElement();
if (ks.getCertificate(alias).getType().equals("X.509"))
{
Date expires = ((X509Certificate) ks.getCertificate(alias)).getNotAfter();
if (expires.before(new Date()))
logger.warn("Certificate for {} expired on {}", alias, expires);
}
}
checkedExpiry = true;
}
kmf.init(ks, options.keystore_password.toCharArray());
ctx.init(kmf.getKeyManagers(), trustManagers, null);