[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ignite TC Bot updated IGNITE-29212:
-----------------------------------
External issue ID: IGN-2932
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
>
> HTTP REST certificates configured in Jetty XML currently require a node
> restart to replace. Add {{ConnectorConfiguration.httpSslFactory}} and
> {{httpSslClientAuth}} so HTTPS can use the node's managed SSL context and
> participate in reload and status.
> h3. Required behavior
> * Support the built-in Jetty connector and HTTP connectors supplied through
> Jetty XML. Preserve the factory's protocols and cipher suites, Jetty's
> applicable cipher exclusions and existing SecureRequestCustomizer settings.
> * Refuse startup if httpSslFactory is combined with a connector's own TLS or
> the PROXY protocol. Also refuse httpSslClientAuth=true without httpSslFactory.
> * Keep existing Jetty XML TLS configurations working unchanged when
> httpSslFactory is not configured.
> * Use the new context for new HTTPS connections and keep existing connections
> usable. A failed reload must retain the working context.
> * Keep client authentication enforced after certificate and trust-store
> changes.
> h3. Tests and documentation
> Cover certificate reload, existing connections, failed replacement, mutual
> TLS, trust-store changes, supported XML connectors, configuration errors and
> legacy XML compatibility. Check both the factory's allowed cipher suites and
> the suites excluded by Jetty, before and after reload.
> Explain migration from Jetty XML: key-store requirements, protocols and
> cipher suites, client authentication, customizers that must be preserved, the
> required restart and verification with the application's host names and
> certificates.
> h3. Dependencies and remaining work
> The branch {{ignite-29212}} is prepared. Open its PR after IGNITE-29210 is
> merged, then run CI on the updated branch. Keep this integration independent
> of automatic renewal in IGNITE-29211.
> When both IGNITE-29211 and IGNITE-29212 are present, verify HTTPS with
> automatic renewal and document it in the renewal configuration table, HTTP
> REST guide and ConnectorConfiguration Javadoc. Include the combined
> documentation with whichever change merges second.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
