Anton Vinogradov created IGNITE-29212:
-----------------------------------------
Summary: Support certificate reload for HTTP REST
Key: IGNITE-29212
URL: https://issues.apache.org/jira/browse/IGNITE-29212
Project: Ignite
Issue Type: Sub-task
Reporter: Anton Vinogradov
Assignee: Anton Vinogradov
HTTP REST certificates configured directly in Jetty XML currently require a
node restart to replace. Add ConnectorConfiguration.httpSslFactory and
httpSslClientAuth so HTTPS can use the node's managed SSL context and
participate in certificate reload and status. The same integration should allow
automatic renewal when it is enabled on the factory.
Apply the factory to the built-in Jetty connector and supported connectors
supplied through Jetty XML. Preserve the factory's protocols and cipher suites,
Jetty's applicable cipher exclusions, and existing SecureRequestCustomizer
settings. Reject configurations that combine httpSslFactory with a connector's
own TLS or with the PROXY protocol, and reject httpSslClientAuth=true without
httpSslFactory. Existing Jetty XML TLS configurations must continue to work
unchanged when the new factory is not configured.
New HTTPS connections must use the replaced context while existing connections
remain usable. A failed reload must retain the working context, and client
authentication must remain enforced after certificate and trust-store changes.
Include tests for these behaviors, supported XML connectors, configuration
errors, and legacy XML compatibility. Add migration instructions covering
key-store requirements, protocols and ciphers, client authentication, preserved
customizers, restart steps, and verification with application host names and
certificates.
Depends on IGNITE-29210. Keep this integration independent of the
automatic-renewal implementation in IGNITE-29211.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
