Use custom TLS certificates in WebSocket API and improve default TLS certificate length

Detail name	Value
Changelog Number	10950
Type	Bug
Status	Resolved
Affected Versions	Exasol 6.2.4
Fix Versions	Exasol 7.0.4, Exasol 6.2.12
Resolution Date	2020-10-15

Background

ExaOperation has offered for a long time the possibility to upload a custom TLS certificate ("TLS Certificate" tab under Configuration > Access Management). This was so far used e.g. for

• ExaOperation https web access
• backups via https and ftps
• BucketFS.

However, access to the database using the WebSocket API used a self-signed and automatically generated certificate instead.

Additionally, the autogenerated TLS certificates had a length of 1024 bit, which is considered too weak (see e.g. https://www.tenable.com/plugins/nessus/69551 severity low)

Improvement

• If a custom TLS certificate was uploaded in ExaOperation, this one will be used for WebSocket database connections instead of the autogenerated self-signed TLS-certificate. 
• Also, if no custom certificate was uploaded, the default autogenerated TLS certificate for the database has been increased from 1024 to 2048 bits.

Please note that this does not affect at all ODBC, JDBC and ADO.NET which are using a different protocol on the database port, but only connections over the WebSocket API (e.g. via pyExasol).

Changed behavior

If a custom TLS certificate was uploaded in ExaOperation, it will be used for WebSocket database connections instead of an autogenerated self-signed TLS-certificate. This does not affect ODBC, JDBC and ADO.NET, but only WebSocket API (e.g. via pyExasol). Also, if no custom certificate was uploaded, the default autogenerated TLS certificate for the database will be increased from 1024 to 2048 bits. See the issue description for more details.