[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-28867:
--------------------------------------
Description:
Administrators can replace TLS certificates and trust stores on running nodes.
Another system delivers the certificates. With automatic renewal, a node can
load a replacement before the earliest chain expires. Existing connections stay
open.
h3. Scope and merge order
# IGNITE-29208 preserves the peer address on wrapped SSL engines. [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 loads the TLS context and its certificate chains together.
IGNITE-29210 uses this bundle for the reload and status commands.
# IGNITE-29211 adds scheduled renewal and retries. IGNITE-29212 extends the
commands to HTTP REST. These two parts can merge in either order after
IGNITE-29210.
After each prerequisite is squash-merged, update the dependent branches and
verify that each PR diff against master contains only its remaining changes.
Once both HTTP and renewal are present, include the [joint HTTPS renewal test
and
documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
once in the PR merged second.
h3. Completion
Verify rotation on new mutual TLS and HTTPS connections, continuity of
established connections, and recovery after an invalid replacement. Each PR
records its checks. See the [rollout
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
for the order of peer trust and certificate updates.
was:
Administrators can replace TLS certificates and trust stores on running nodes.
Another system delivers the certificates. With automatic renewal, a node can
load a replacement before the earliest chain expires. Existing connections stay
open.
h3. Scope and merge order
# IGNITE-29208 preserves the peer address on wrapped SSL engines. [PR
#13750|https://github.com/apache/ignite/pull/13750] is merged.
# IGNITE-29209 loads the TLS context and its certificate chains together.
IGNITE-29210 uses this bundle for the reload and status commands.
# IGNITE-29211 adds scheduled renewal and retries. IGNITE-29212 extends the
commands to HTTP REST. These two parts can merge in either order after
IGNITE-29210.
After each prerequisite is squash-merged, update the dependent branches and
verify that each PR diff against master contains only its remaining changes.
Once both HTTP and renewal are present, include the [joint HTTPS renewal test
and
documentation|https://github.com/anton-vinogradov/ignite/commit/74669cb8120c16c6f00ae622e7d41a33ccd17265]
once in the PR merged second.
h3. Completion
Verify rotation on new mutual TLS and HTTPS connections, continuity of
established connections, and recovery after an invalid replacement. Each PR
records its checks. See the [rollout
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
for the order of peer trust and certificate updates.
> [Umbrella] TLS certificate reload and automatic renewal
> -------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 7h
> Remaining Estimate: 0h
>
> Administrators can replace TLS certificates and trust stores on running
> nodes. Another system delivers the certificates. With automatic renewal, a
> node can load a replacement before the earliest chain expires. Existing
> connections stay open.
> h3. Scope and merge order
> # IGNITE-29208 preserves the peer address on wrapped SSL engines. [PR
> #13750|https://github.com/apache/ignite/pull/13750] is merged.
> # IGNITE-29209 loads the TLS context and its certificate chains together.
> IGNITE-29210 uses this bundle for the reload and status commands.
> # IGNITE-29211 adds scheduled renewal and retries. IGNITE-29212 extends the
> commands to HTTP REST. These two parts can merge in either order after
> IGNITE-29210.
> After each prerequisite is squash-merged, update the dependent branches and
> verify that each PR diff against master contains only its remaining changes.
> Once both HTTP and renewal are present, include the [joint HTTPS renewal test
> and
> documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
> once in the PR merged second.
> h3. Completion
> Verify rotation on new mutual TLS and HTTPS connections, continuity of
> established connections, and recovery after an invalid replacement. Each PR
> records its checks. See the [rollout
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates]
> for the order of peer trust and certificate updates.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
