Default to SSL with hardcoded AWS Redshift CA#20
Conversation
graingert
force-pushed
the
enable-tls-by-default
branch
from
992b245 to
9d7340e
Compare
graingert
force-pushed
the
enable-tls-by-default
branch
from
9d7340e to
1e09e37
Compare
|
lgtm, and I think it makes sense to use SSL by default. |
Default to SSL with hardcoded AWS Redshift CA
There was a problem hiding this comment.
From http://docs.aws.amazon.com/redshift/latest/mgmt/connecting-ssl-support.html:
Amazon Redshift does not support verify-full. For more information about sslmode options, see SSL Support in the PostgreSQL documentation.
So, if this is working, it's probably not doing what we think it's doing.
There was a problem hiding this comment.
I've been running with verify-full in production for several months now
There was a problem hiding this comment.
I think using "sslrootcert" is making this work for us
There was a problem hiding this comment.
I'll mess about with wireshark on this at home.
There was a problem hiding this comment.
It looks like the redshift cluster is sending a valid ServerCertificate (when validated with redshift-ssl-ca-cert.pem) with the correct common name: "redshift-sqlalchemy-test.cforsfjmjsja.us-west-2.redshift.amazonaws.com" see https://gist.github.com/graingert/3a46c493520db7caa460#file-redshift-tls-server-hello-txt-L188
So there is no reason that verify-ssl should not be working as designed.
There was a problem hiding this comment.
I'll be sticking with "verify-full" unless someone reports issues with it, because the documentation on that page that's not wrong is dangerous.
Under the configuration here: https://docs.aws.amazon.com/redshift/latest/mgmt/connecting-ssl-support.html clients will accept certificates minted by Amazon for any Internet server, and anyone with any valid certificate will be able to MITM connections to the redshift server.
If you're using "verify-ca" with your system ca-store your connection can be easily compromised with any free x509 certificate.
…y-default Default to SSL with hardcoded AWS Redshift CA
3 participants
You can still override this by setting
{'sslmode': 'disable'}In fact I'd recommend using
{'sslmode': 'verify-full', 'sslrootcert': '/path/to/redshift-ssl-ca-cert.pem'}