Uploaded image for project: 'netconf'
  1. netconf
  2. NETCONF-1205

Support private keys and trusted certificates configuration on per TLS device basis

    XMLWordPrintable

Details

    • Improvement
    • Status: Open
    • Medium
    • Resolution: Unresolved
    • None
    • None
    • None

    Description

      Current odl-netconf-device model (and netconf-node-topology as result) provides no configuration option which defines which private key and trusted certificate to be used by SslHandler when establishing TLS connection. In fact SslHandler is built using a KeyStore instance containing all the private keys and all the trusted certificates which are currently defined in a datastore.

      More entries are defined in datastore the larger SslHandler instance became, the longer handshake procedure may take. Using same set of keys and certificates for any TLS device may also cause in issue when single un-parseable entry results every TLS device connection failure as described in NETCONF-821

      In order to lightweight SslHandler instance, making handshake faster, configuration more clear and transparent it seems reasonable to provide per device TLS options.

      Suggested following configuration options under TLS container (connection-parameters grouping):

      • leaf-list private-key-id – private key ids
      • leaf-list trusted-certificate-id – trusted certificate ids

      Both expected to be optional and act as filter if defined, full set to be used if undefined

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              Unassigned Unassigned
              rkashapov Ruslan Kashapov
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated: