DongyuanPan commented on code in PR #238:
URL: https://github.com/apache/rocketmq-mqtt/pull/238#discussion_r1496811401
##########
mqtt-cs/src/main/java/org/apache/rocketmq/mqtt/cs/protocol/ssl/SslFactory.java:
##########
@@ -71,6 +76,55 @@ private void initSslContext() {
}
}
+ @PostConstruct
+ private void onSslCertChanged() {
+ if (!connectConf.isEnableTlsSever()) {
+ return;
+ }
+
+ String[] watchFiles = {connectConf.getSslServerCertFile(),
connectConf.getSslServerKeyFile(),
+ connectConf.getSslCaCertFile()};
+
+ FileWatchService.Listener listener = new FileWatchService.Listener() {
+
+ boolean certChanged, keyChanged = false;
+
+ @Override
+ public void onChanged(String path) {
+ if (path.equals(connectConf.getSslCaCertFile())) {
+ LOG.info("The trust certificate changed, reload the ssl
context");
+ initSslContext();
+ }
+ if (path.equals(connectConf.getSslServerCertFile())) {
+ certChanged = true;
+ }
+ if (path.equals(connectConf.getSslServerKeyFile())) {
+ keyChanged = true;
+ }
+ if (certChanged && keyChanged) {
+ LOG.info("The certificate and private key changed, reload
the ssl context");
+ certChanged = false;
+ keyChanged = false;
+ initSslContext();
+ }
+ }
+ };
+
+ try {
+ fileWatchService = new FileWatchService(watchFiles, listener);
+ fileWatchService.start();
+ } catch (Exception e) {
+ LOG.warn("FileWatchService created error, can't load the
certificate dynamically");
+ }
+ }
+
+ @PreDestroy
+ private void destroy() {
+ if (this.fileWatchService != null) {
+ this.fileWatchService.shutdown();
+ }
+ }
+
public SSLEngine buildSslEngine(SocketChannel ch) {
Review Comment:
sslContext has been reloaded, SSLEngine should also be reloaded. If you want
the reloaded certificate to take effect, do you need to restart the port
listening in MqttServer#startTls?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
