[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29210:
--------------------------------------
Description:
Administrators can reload node certificates and trust stores and inspect the
result without restarting the cluster. The commands cover discovery,
communication, the client connector and binary REST on every selected server
and client node.
h3. Result
* {{control.sh --ssl reload}} updates each distinct registered factory once per
node. Transports that share it use the replacement for new connections.
Existing connections stay open. A rejected replacement keeps the previous
context in service.
* Reload requires a fresh context, TLS engines and stream sockets. It checks
validity dates on all reported chains and rejects a known empty chain map.
First initialization permits expired certificates and keyless stores. A
subclass that calls {{init()}} again on the same factory at restart gets the
reload checks. A plain {{Factory<SSLContext>}} supplies no metadata, so reload
can accept its new context without a date check.
* {{control.sh --ssl status}} identifies the transports and key aliases for
each factory and distinguishes an empty store from unavailable metadata. Both
commands require {{ADMIN_OPS}}. Reload records the initiator and reports any
failed node or factory while processing the others.
h3. Compatibility
A plain factory is called when its first transport registers and on reload. It
must return a fresh context to rotate material. Custom discovery SPI subclasses
using the removed protected socket-factory fields need adaptation. Configure
peer trust before rotating keys and check it with a new connection. See the
[rollout and recovery
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
[PR #13785 and validation|https://github.com/apache/ignite/pull/13785] builds
on IGNITE-29209.
was:
Administrators can reload node certificates and trust stores and inspect the
result without restarting the cluster. The commands cover discovery,
communication, the client connector and binary REST on every selected server
and client node.
h3. Result
* {{control.sh --ssl reload}} updates each distinct registered factory once per
node. Transports that share it use the replacement for new connections.
Existing connections stay open. A rejected replacement keeps the previous
context in service.
* Reload requires a fresh context, TLS engines and stream sockets. It checks
validity dates on all reported chains and rejects a known empty chain map.
Startup still permits expired certificates and keyless stores. A plain
{{Factory<SSLContext>}} supplies no metadata, so reload can accept its new
context without a date check.
* {{control.sh --ssl status}} identifies the transports and key aliases for
each factory and distinguishes an empty store from unavailable metadata. Both
commands require {{ADMIN_OPS}}. Reload records the initiator and reports any
failed node or factory while processing the others.
h3. Compatibility
A plain factory is called when its first transport registers and on reload. It
must return a fresh context to rotate material. Custom discovery SPI subclasses
using the removed protected socket-factory fields need adaptation. Configure
peer trust before rotating keys and check it with a new connection. See the
[rollout and recovery
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
[PR #13785 and validation|https://github.com/apache/ignite/pull/13785] builds
on IGNITE-29209.
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Administrators can reload node certificates and trust stores and inspect the
> result without restarting the cluster. The commands cover discovery,
> communication, the client connector and binary REST on every selected server
> and client node.
> h3. Result
> * {{control.sh --ssl reload}} updates each distinct registered factory once
> per node. Transports that share it use the replacement for new connections.
> Existing connections stay open. A rejected replacement keeps the previous
> context in service.
> * Reload requires a fresh context, TLS engines and stream sockets. It checks
> validity dates on all reported chains and rejects a known empty chain map.
> First initialization permits expired certificates and keyless stores. A
> subclass that calls {{init()}} again on the same factory at restart gets the
> reload checks. A plain {{Factory<SSLContext>}} supplies no metadata, so
> reload can accept its new context without a date check.
> * {{control.sh --ssl status}} identifies the transports and key aliases for
> each factory and distinguishes an empty store from unavailable metadata. Both
> commands require {{ADMIN_OPS}}. Reload records the initiator and reports any
> failed node or factory while processing the others.
> h3. Compatibility
> A plain factory is called when its first transport registers and on reload.
> It must return a fresh context to rotate material. Custom discovery SPI
> subclasses using the removed protected socket-factory fields need adaptation.
> Configure peer trust before rotating keys and check it with a new connection.
> See the [rollout and recovery
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
> [PR #13785 and validation|https://github.com/apache/ignite/pull/13785] builds
> on IGNITE-29209.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
