[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
A custom SSL factory can obtain a certificate and its initialized context from
one key-store read. This lets a subclass authenticate a restarted node with the
same certificate its TLS connections will use. The manual reload and automatic
renewal tasks use the same snapshot.
h3. Result
* The first {{create()}} initializes the context once. Subsequent callers get
the accepted context while another thread reloads it. A subclass can call
protected {{init()}} to load and publish fresh material. If loading fails, the
previous context, engines and sockets remain usable.
* The snapshot contains immutable X.509 chains by private-key alias. An empty
map means the store has no such chains. A custom source that cannot report its
chains returns null metadata.
* Serialization keeps the configuration. Restoring a serialized factory reloads
material on first use.
h3. Compatibility
Update and recompile subclasses that override {{create()}}, declare a
conflicting {{init()}}, implement the old {{createKeyManagers()}} hook or use
the protected {{sslCtx}} field. A subclass can still supply a null key store
for a client without its own key. Unknown protocol or cipher suite names now
fail at first initialization, including node startup. See the [subclass
migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
[PR #13751 and validation|https://github.com/apache/ignite/pull/13751].
was:
A custom SSL factory can obtain a certificate and its initialized context from
one key-store read. This lets a subclass authenticate a restarted node with the
same certificate its TLS connections will use. The manual reload and automatic
renewal tasks use the same snapshot.
h3. Result
* The first {{create()}} initializes the context once. Subsequent callers get
the accepted context while another thread reloads it. A subclass can call
protected {{init()}} to load and publish fresh material. If loading fails, the
previous context, engines and sockets remain usable.
* The snapshot contains immutable X.509 chains by private-key alias. An empty
map means the store has no such chains. A custom source that cannot report its
chains returns null metadata.
* Serialization keeps the configuration. Restoring a serialized factory reloads
material on first use.
h3. Compatibility
Update and recompile subclasses declaring a conflicting {{init()}} method or
overriding {{create()}}, implementing the old {{createKeyManagers()}} hook or
using the protected {{sslCtx}} field. A subclass can still supply a null key
store for a client without its own key. Unknown protocol or cipher suite names
now fail at first initialization, including node startup. See the [subclass
migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
[PR #13751 and validation|https://github.com/apache/ignite/pull/13751].
> Add SSL bundle metadata and explicit factory initialization
> -----------------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 4h 10m
> Remaining Estimate: 0h
>
> A custom SSL factory can obtain a certificate and its initialized context
> from one key-store read. This lets a subclass authenticate a restarted node
> with the same certificate its TLS connections will use. The manual reload and
> automatic renewal tasks use the same snapshot.
> h3. Result
> * The first {{create()}} initializes the context once. Subsequent callers get
> the accepted context while another thread reloads it. A subclass can call
> protected {{init()}} to load and publish fresh material. If loading fails,
> the previous context, engines and sockets remain usable.
> * The snapshot contains immutable X.509 chains by private-key alias. An empty
> map means the store has no such chains. A custom source that cannot report
> its chains returns null metadata.
> * Serialization keeps the configuration. Restoring a serialized factory
> reloads material on first use.
> h3. Compatibility
> Update and recompile subclasses that override {{create()}}, declare a
> conflicting {{init()}}, implement the old {{createKeyManagers()}} hook or use
> the protected {{sslCtx}} field. A subclass can still supply a null key store
> for a client without its own key. Unknown protocol or cipher suite names now
> fail at first initialization, including node startup. See the [subclass
> migration
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> [PR #13751 and validation|https://github.com/apache/ignite/pull/13751].
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
