[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
With {{ConnectorConfiguration.httpSslFactory}}, {{control.sh --ssl reload}}
loads new certificates and trust stores for HTTP REST. {{--ssl status}} lists
them under HTTP REST. New HTTPS connections use the new certificates.
Established connections stay open, and a failed reload keeps the existing
material.
h3. Result
* Support the built-in HTTP connector and connectors from Jetty XML. Jetty
applies its default exclusions to the factory's protocols and cipher suites.
With {{httpSslClientAuth=true}}, new connections require a trusted client
certificate.
* A node running HTTP REST fails to start if client authentication is enabled
without {{httpSslFactory}}, or if a connector using that factory already
configures TLS or a default protocol other than HTTP.
* With {{httpSslFactory}}, HTTP REST accepts a Host header absent from the
certificate by default. An explicit Jetty {{SecureRequestCustomizer}} keeps its
Host check. TLS configured in Jetty XML remains outside Ignite's reload and
status commands. Moving TLS from XML to the factory requires a rolling restart.
[HTTPS migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload].
* If HTTP and binary REST share one {{LifecycleAware}} factory, the node starts
and stops it once.
Builds on IGNITE-29210. Code and validation are in [PR
#13787|https://github.com/apache/ignite/pull/13787]. Once both this task and
IGNITE-29211 are present, include the [joint HTTPS renewal test and
documentation|https://github.com/anton-vinogradov/ignite/commit/74669cb8120c16c6f00ae622e7d41a33ccd17265]
once in the PR merged second.
was:
With {{ConnectorConfiguration.httpSslFactory}}, operators can rotate HTTP REST
certificates and peer trust through the node's existing TLS commands. New HTTPS
connections use the accepted material. Established connections stay open and a
failed reload keeps the working context.
h3. Result
* Support the built-in HTTP connector and connectors supplied by Jetty XML.
Preserve the factory's TLS protocols and ciphers, Jetty exclusions, and
explicit secure request customizers.
* With {{httpSslClientAuth=true}}, require a trusted client certificate on
every new connection. A node running HTTP REST fails to start if client
authentication is enabled without {{httpSslFactory}}, or if a connector
configured for that factory has its own TLS or a default protocol other than
HTTP. If HTTP and binary REST share a {{LifecycleAware}} factory, the node
starts and stops it once.
* An Ignite-managed connector accepts a Host name absent from the certificate
by default. To keep Jetty host checks, configure a {{SecureRequestCustomizer}}
explicitly. Jetty-owned TLS retains its own policy. Moving ownership requires a
rolling restart. The [migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload]
covers optional client authentication, alias selection, revocation and host
validation.
[PR #13787 and validation|https://github.com/apache/ignite/pull/13787] builds
on IGNITE-29210. Once this task and IGNITE-29211 are present, apply the [HTTPS
renewal test and
documentation|https://github.com/anton-vinogradov/ignite/commit/b4f505eeea2a448b67e2234b5bb3368768646e25]
once in the PR merged second.
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 40m
> Remaining Estimate: 0h
>
> With {{ConnectorConfiguration.httpSslFactory}}, {{control.sh --ssl reload}}
> loads new certificates and trust stores for HTTP REST. {{--ssl status}} lists
> them under HTTP REST. New HTTPS connections use the new certificates.
> Established connections stay open, and a failed reload keeps the existing
> material.
> h3. Result
> * Support the built-in HTTP connector and connectors from Jetty XML. Jetty
> applies its default exclusions to the factory's protocols and cipher suites.
> With {{httpSslClientAuth=true}}, new connections require a trusted client
> certificate.
> * A node running HTTP REST fails to start if client authentication is enabled
> without {{httpSslFactory}}, or if a connector using that factory already
> configures TLS or a default protocol other than HTTP.
> * With {{httpSslFactory}}, HTTP REST accepts a Host header absent from the
> certificate by default. An explicit Jetty {{SecureRequestCustomizer}} keeps
> its Host check. TLS configured in Jetty XML remains outside Ignite's reload
> and status commands. Moving TLS from XML to the factory requires a rolling
> restart. [HTTPS migration
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload].
> * If HTTP and binary REST share one {{LifecycleAware}} factory, the node
> starts and stops it once.
> Builds on IGNITE-29210. Code and validation are in [PR
> #13787|https://github.com/apache/ignite/pull/13787]. Once both this task and
> IGNITE-29211 are present, include the [joint HTTPS renewal test and
> documentation|https://github.com/anton-vinogradov/ignite/commit/74669cb8120c16c6f00ae622e7d41a33ccd17265]
> once in the PR merged second.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
