TLS Certificate Verification for Loader File Connections (CSV, FBV, LOCAL files)

Details

Detail name	Value
Changelog Number	16273
Type	Improvement
Status	Resolved
Fix Versions	Exasol 8.32.0
Resolution Date	2024-11-08

Background

The loader did not verify TLS certificates for its file connections (CSV, FBV, LOCAL files) except AZURE BLOBSTORAGE, leaving users potentially vulnerable to man-in-the-middle attacks, and there was no option available to enable certificate verification for IMPORT and EXPORT statements.

Improvement

TLS Certificate Verification for External Connections
The loader now supports verification of TLS certificates for all file connections, such as HTTPS and FTPS. This ensures enhanced security for all data transfers.
Customizable Certificate Validation
Users can control certificate validation using both database parameters and SQL syntax, enabling a flexible approach to security:

Database Parameter:
SQL Syntax Options:
Users can enable or disable certificate verification directly in the IMPORT and EXPORT statements. Options include:

-etlCheckCertsDefault=1: Enables certificate checking by default.
-etlCAPath=<Path to CA>: Allows users to specify the path to the certificate authority (CA) file or directory on data nodes.

VERIFY CERTIFICATE: Activates certificate verification.
IGNORE CERTIFICATE: Deactivates certificate verification.
PUBLIC KEY 'sha256//*******': Specifies the public key for certificate verification.

Example SQL Syntax

-- Activate certificate verification and provide a public key
IMPORT INTO Test.DB FROM CSV AT 'https://localhost:8511/' VERIFY CERTIFICATE PUBLIC KEY 'sha256//sdfsef' FILE 'Test.csv';

-- Deactivate certificate verification
IMPORT INTO Test.DB FROM CSV AT 'https://localhost:8511/' IGNORE CERTIFICATE FILE 'Test.csv';

-- Provide only a public key for certificate validation
IMPORT INTO Test.DB FROM CSV AT 'https://localhost:8511/' PUBLIC KEY 'sha256//sdfsef' FILE 'Test.csv';

Note: If a public key is provided, it takes precedence over other certificate verification settings.

Default Behavior

TLS certificate verification is deactivated by default. However, users can enable it using the database parameter or the SQL syntax if required.

Additional Information

For detailed SQL syntax and configuration options, please refer to the following documentation pages: