[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
A custom SSL factory can load its TLS context and private-key certificate
chains together. A subclass can use a certificate from this bundle to
authenticate a restarted node. IGNITE-29210 and IGNITE-29211 use the same
bundle for reload and renewal.
h3. Result
* The first {{create()}} loads the material. Once initialized, it returns the
current context immediately, even while a replacement loads. A subclass can
call protected {{init()}} at node startup to reread its source. If that load
fails, existing contexts, engines and sockets remain usable.
* Until IGNITE-29210, transports on a running node keep the contexts obtained
at startup. Only new outgoing communication connections pick up a replacement.
* The bundle contains immutable X.509 chains by private-key alias. An empty map
means the source has no such chains. A source unable to report its chains
supplies null metadata. Serialization preserves the factory configuration and
first use after deserialization loads the material again.
h3. Compatibility
Update and recompile subclasses that override {{create()}}, declare their own
no-argument {{init()}}, implement the former {{createKeyManagers()}} hook or
use the former {{sslCtx}} field. Client factories may return a null key store.
Unknown protocol or cipher names fail at first initialization, including node
startup. [Subclass migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
Code and validation are in [PR
#13751|https://github.com/apache/ignite/pull/13751].
was:
A custom SSL factory can obtain a certificate and its initialized context from
one key-store read. This lets a subclass authenticate a restarted node with the
same certificate its TLS connections will use. The manual reload and automatic
renewal tasks use the same snapshot.
h3. Result
* The first {{create()}} initializes the context once. Subsequent callers get
the accepted context while another thread reloads it. A subclass can call
protected {{init()}} to load and publish fresh material. If loading fails, the
previous context, engines and sockets remain usable.
* The snapshot contains immutable X.509 chains by private-key alias. An empty
map means the store has no such chains. A custom source that cannot report its
chains returns null metadata.
* Serialization keeps the configuration. Restoring a serialized factory reloads
material on first use.
h3. Compatibility
Update and recompile subclasses that override {{create()}}, declare a
conflicting {{init()}}, implement the old {{createKeyManagers()}} hook or use
the protected {{sslCtx}} field. A subclass can still supply a null key store
for a client without its own key. Unknown protocol or cipher suite names now
fail at first initialization, including node startup. See the [subclass
migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
[PR #13751 and validation|https://github.com/apache/ignite/pull/13751].
> Add SSL bundle metadata and explicit factory initialization
> -----------------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 4h 10m
> Remaining Estimate: 0h
>
> A custom SSL factory can load its TLS context and private-key certificate
> chains together. A subclass can use a certificate from this bundle to
> authenticate a restarted node. IGNITE-29210 and IGNITE-29211 use the same
> bundle for reload and renewal.
> h3. Result
> * The first {{create()}} loads the material. Once initialized, it returns the
> current context immediately, even while a replacement loads. A subclass can
> call protected {{init()}} at node startup to reread its source. If that load
> fails, existing contexts, engines and sockets remain usable.
> * Until IGNITE-29210, transports on a running node keep the contexts obtained
> at startup. Only new outgoing communication connections pick up a replacement.
> * The bundle contains immutable X.509 chains by private-key alias. An empty
> map means the source has no such chains. A source unable to report its chains
> supplies null metadata. Serialization preserves the factory configuration and
> first use after deserialization loads the material again.
> h3. Compatibility
> Update and recompile subclasses that override {{create()}}, declare their own
> no-argument {{init()}}, implement the former {{createKeyManagers()}} hook or
> use the former {{sslCtx}} field. Client factories may return a null key
> store. Unknown protocol or cipher names fail at first initialization,
> including node startup. [Subclass migration
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> Code and validation are in [PR
> #13751|https://github.com/apache/ignite/pull/13751].
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
