[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
When a node restarts with the same SSL factory instance, the factory can now
reload its TLS settings, keys and trust material by calling the protected
{{init()}} method.
{{init()}} validates the configured protocols and cipher suites before
replacing the context. If loading or validation fails, the base {{create()}}
continues to return the previous working context. A deserialized factory loads
its context from its configuration on first use.
h3. Compatibility
The existing key and trust manager hooks stay in place. Subclasses that used
the protected {{sslCtx}} field can get the current context through {{create()}}
and replace it through {{init()}}. Rename an existing no-argument {{init()}} in
a subclass before recompiling.
[PR #13751|https://github.com/apache/ignite/pull/13751]
was:
A custom SSL factory can load its TLS context and private-key certificate
chains together. A subclass can use a certificate from this bundle to
authenticate a restarted node. IGNITE-29210 and IGNITE-29211 use the same
bundle for reload and renewal.
h3. Result
* The first {{create()}} loads the material. Once initialized, it returns the
current context immediately, even while a replacement loads. A subclass can
call protected {{init()}} at node startup to reread its source. If that load
fails, existing contexts, engines and sockets remain usable.
* Until IGNITE-29210, transports on a running node keep the contexts obtained
at startup. Only new outgoing communication connections pick up a replacement.
* The bundle contains immutable X.509 chains by private-key alias. An empty map
means the source has no such chains. A source unable to report its chains
supplies null metadata. Serialization preserves the factory configuration and
first use after deserialization loads the material again.
h3. Compatibility
Update and recompile subclasses that override {{create()}}, declare their own
no-argument {{init()}}, implement the former {{createKeyManagers()}} hook or
use the former {{sslCtx}} field. Client factories may return a null key store.
Unknown protocol or cipher names fail at first initialization, including node
startup. [Subclass migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
Code and validation are in [PR
#13751|https://github.com/apache/ignite/pull/13751].
Summary: Allow SSL context factories to reload their context (was: Add
SSL bundle metadata and explicit factory initialization)
> Allow SSL context factories to reload their context
> ---------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 5h
> Remaining Estimate: 0h
>
> When a node restarts with the same SSL factory instance, the factory can now
> reload its TLS settings, keys and trust material by calling the protected
> {{init()}} method.
> {{init()}} validates the configured protocols and cipher suites before
> replacing the context. If loading or validation fails, the base {{create()}}
> continues to return the previous working context. A deserialized factory
> loads its context from its configuration on first use.
> h3. Compatibility
> The existing key and trust manager hooks stay in place. Subclasses that used
> the protected {{sslCtx}} field can get the current context through
> {{create()}} and replace it through {{init()}}. Rename an existing
> no-argument {{init()}} in a subclass before recompiling.
> [PR #13751|https://github.com/apache/ignite/pull/13751]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
