[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
With {{ConnectorConfiguration.httpSslFactory}}, operators can rotate HTTP REST
certificates and peer trust through the node's existing TLS commands. New HTTPS
connections use the accepted material. Established connections stay open and a
failed reload keeps the working context.
h3. Result
* Support the built-in HTTP connector and connectors supplied by Jetty XML.
Preserve the factory's TLS protocols and ciphers, Jetty exclusions, and
explicit secure request customizers.
* With {{httpSslClientAuth=true}}, require a trusted client certificate on
every new connection. The connector must use HTTP as its default protocol and
leave TLS to the Ignite factory.
* An Ignite-managed connector accepts a Host name absent from the certificate
by default. To keep Jetty host checks, configure a {{SecureRequestCustomizer}}
explicitly. Jetty-owned TLS retains its own policy. Moving ownership requires a
rolling restart. The [migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload]
covers optional client authentication, alias selection, revocation and host
validation.
[PR #13787 and validation|https://github.com/apache/ignite/pull/13787] builds
on IGNITE-29210. Once this task and IGNITE-29211 are present, apply the [HTTPS
renewal test and
documentation|https://github.com/anton-vinogradov/ignite/commit/d554ba23f34e7227f6c998284934a3e1af426d2b]
once in the PR merged second.
was:
Let HTTP REST use the same certificate reload and status workflow as other node
transports. {{ConnectorConfiguration.httpSslFactory}} allows HTTPS certificate
and trust-store rotation without restarting the connector. With IGNITE-29211,
the same factory can also renew certificates automatically.
h3. Result and acceptance
* Support built-in and XML-supplied Jetty HTTP connectors. New HTTPS
connections use replacement material, established connections remain usable,
and failed reloads retain the working context.
* Preserve factory protocols/cipher suites, applicable Jetty cipher exclusions
and explicitly configured {{SecureRequestCustomizer}} settings.
* {{httpSslClientAuth=true}} requires {{httpSslFactory}} and a trusted client
certificate before and after certificate/trust changes. Reject a managed
factory combined with the connector's own TLS configuration or PROXY protocol.
* Keep existing Jetty-owned TLS working when {{httpSslFactory}} is absent.
Verify real HTTPS connections, mutual TLS, XML connectors and rejected startup
configurations.
h3. Migration boundaries
Moving TLS ownership from Jetty XML requires a rolling restart. Client
authentication, host/SNI checks and revocation policy must be preserved
explicitly; settings are not all transferred automatically.
The standard Ignite factory has no key-alias selector: preserve a selected
alias with a store containing only that key and matching key/store passwords.
{{httpSslClientAuth}} does not represent optional {{wantClientAuth}}; use a
custom factory or retain Jetty TLS. Reproduce Jetty CRL/OCSP checks through
suitable trust managers or retain Jetty TLS. Explicitly configured
{{trustManagers}} remain in use; peer trust remains an operator responsibility.
See [Jetty XML
migration|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload],
including implicit {{SecureRequestCustomizer}} host checks, and the
[ConnectorConfiguration
contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/modules/core/src/main/java/org/apache/ignite/configuration/ConnectorConfiguration.java#L528].
h3. Delivery and automatic renewal
Depends on IGNITE-29210 and works independently of IGNITE-29211. Once both
renewal and HTTP are present, include the [joint integration
commit|https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599]
once in the PR that merges second; it adds HTTPS renewal coverage and
documentation.
Local checks: all 9 HTTP cases and Checkstyle passed at {{271ff0ed}}; combined
HTTPS renewal passed at {{fe6d4afd}}. This is not full CI.
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 40m
> Remaining Estimate: 0h
>
> With {{ConnectorConfiguration.httpSslFactory}}, operators can rotate HTTP
> REST certificates and peer trust through the node's existing TLS commands.
> New HTTPS connections use the accepted material. Established connections stay
> open and a failed reload keeps the working context.
> h3. Result
> * Support the built-in HTTP connector and connectors supplied by Jetty XML.
> Preserve the factory's TLS protocols and ciphers, Jetty exclusions, and
> explicit secure request customizers.
> * With {{httpSslClientAuth=true}}, require a trusted client certificate on
> every new connection. The connector must use HTTP as its default protocol and
> leave TLS to the Ignite factory.
> * An Ignite-managed connector accepts a Host name absent from the certificate
> by default. To keep Jetty host checks, configure a
> {{SecureRequestCustomizer}} explicitly. Jetty-owned TLS retains its own
> policy. Moving ownership requires a rolling restart. The [migration
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload]
> covers optional client authentication, alias selection, revocation and host
> validation.
> [PR #13787 and validation|https://github.com/apache/ignite/pull/13787] builds
> on IGNITE-29210. Once this task and IGNITE-29211 are present, apply the
> [HTTPS renewal test and
> documentation|https://github.com/anton-vinogradov/ignite/commit/d554ba23f34e7227f6c998284934a3e1af426d2b]
> once in the PR merged second.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
