[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
Certificate reload needs a fresh SSLContext and metadata that describes the
exact key material loaded into it. Reading the key store again for metadata
could report a different certificate if the source changes between reads.
Add AbstractSslContextFactory.createNew() while preserving the existing cached
create() behavior. Introduce KeyMaterial and a compatible createKeyMaterial()
hook that obtains key managers and their certificate chain from one load.
Existing subclasses using createKeyManagers() and createTrustManagers() must
continue to work. SslContextFactory should obtain its metadata from the store
already used to initialize its key managers.
Extend SSLContextWrapper to carry the chain and distinguish material known to
contain no private key from material whose chain is unknown. Preserve the
existing constructor, defensively copy metadata, and retain metadata when
wrapping an existing wrapper. A wrapper carrying metadata alone must preserve
delegate behavior without requiring custom SSLParameters.
Tests should cover cached versus fresh creation, one-load consistency, legacy
hooks, defensive copies, wrapper behavior, and stores with zero, one, or
multiple private keys. Document the extension contracts in Javadoc, including
subclasses that override create(). Keep renewal settings and node reload
behavior in their respective follow-up tasks.
Merge IGNITE-29208 first. This branch includes the same peer-address fix
because metadata wrappers must preserve client behavior even with default TLS
settings. After IGNITE-29208 lands, merge master into this branch normally. If
SecurityTestSuite conflicts, retain both test registrations.
The [manual reload
implementation|https://github.com/anton-vinogradov/ignite/compare/ignite-29209...ignite-29210]
shows how the new API is used.
was:
Certificate reload needs a fresh SSLContext and metadata that describes the
exact key material loaded into it. Reading the key store again for metadata
could report a different certificate if the source changes between reads.
Add AbstractSslContextFactory.createNew() while preserving the existing cached
create() behavior. Introduce KeyMaterial and a compatible createKeyMaterial()
hook that obtains key managers and their certificate chain from one load.
Existing subclasses using createKeyManagers() and createTrustManagers() must
continue to work. SslContextFactory should obtain its metadata from the store
already used to initialize its key managers.
Extend SSLContextWrapper to carry the chain and distinguish material known to
contain no private key from material whose chain is unknown. Preserve the
existing constructor, defensively copy metadata, and retain metadata when
wrapping an existing wrapper. A wrapper carrying metadata alone must preserve
delegate behavior without requiring custom SSLParameters.
Tests should cover cached versus fresh creation, one-load consistency, legacy
hooks, defensive copies, wrapper behavior, and stores with zero, one, or
multiple private keys. Document the extension contracts in Javadoc, including
subclasses that override create(). Keep renewal settings and node reload
behavior in their respective follow-up tasks.
Planned merge order: after IGNITE-29208. There is no functional dependency on
that fix.
> Add fresh SSL contexts with certificate metadata
> ------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Certificate reload needs a fresh SSLContext and metadata that describes the
> exact key material loaded into it. Reading the key store again for metadata
> could report a different certificate if the source changes between reads.
> Add AbstractSslContextFactory.createNew() while preserving the existing
> cached create() behavior. Introduce KeyMaterial and a compatible
> createKeyMaterial() hook that obtains key managers and their certificate
> chain from one load. Existing subclasses using createKeyManagers() and
> createTrustManagers() must continue to work. SslContextFactory should obtain
> its metadata from the store already used to initialize its key managers.
> Extend SSLContextWrapper to carry the chain and distinguish material known to
> contain no private key from material whose chain is unknown. Preserve the
> existing constructor, defensively copy metadata, and retain metadata when
> wrapping an existing wrapper. A wrapper carrying metadata alone must preserve
> delegate behavior without requiring custom SSLParameters.
> Tests should cover cached versus fresh creation, one-load consistency, legacy
> hooks, defensive copies, wrapper behavior, and stores with zero, one, or
> multiple private keys. Document the extension contracts in Javadoc, including
> subclasses that override create(). Keep renewal settings and node reload
> behavior in their respective follow-up tasks.
> Merge IGNITE-29208 first. This branch includes the same peer-address fix
> because metadata wrappers must preserve client behavior even with default TLS
> settings. After IGNITE-29208 lands, merge master into this branch normally.
> If SecurityTestSuite conflicts, retain both test registrations.
> The [manual reload
> implementation|https://github.com/anton-vinogradov/ignite/compare/ignite-29209...ignite-29210]
> shows how the new API is used.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
