[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138517#comment-18138517
]
Anton Vinogradov commented on IGNITE-29212:
-------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13787] verdict for PR
13787 · RunAll build [9472275|https://ci2.ignite.apache.org/build/9472275] ·
tested
[be3f0a8|https://github.com/apache/ignite/pull/13787/commits/be3f0a8558034b16f1a206a02e4a9d8edef480ce]
· 149 suites ran, 0 reused
(/) *No blockers* — nothing in this run looks caused by this PR. 18 failing
tests are not blamed on this PR.
_What each label means and what to do: [verdict
glossary|https://github.com/anton-vinogradov/ignite-pr-checker/blob/main/docs/features.md#verdict-glossary]._
♻️ Settled after 1 auto re-run wave: #1 — 2 suites that failed mid-run.
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h
> Remaining Estimate: 0h
>
> With {{ConnectorConfiguration.httpSslFactory}}, {{control.sh --ssl reload}}
> loads new certificates and trust stores for HTTP REST. New HTTPS connections
> use the new certificates. Established connections stay open, and a failed
> reload keeps the existing material.
> {{--ssl status}} lists them under HTTP REST.
> h3. Result
> * Support the built-in HTTP connector and connectors from Jetty XML. Jetty
> applies its default exclusions to the factory's protocols and cipher suites.
> With {{httpSslClientAuth=true}}, new connections require a trusted client
> certificate.
> * A node running HTTP REST fails to start if {{httpSslClientAuth}} is enabled
> without {{httpSslFactory}}, or if a connector using that factory already
> configures TLS or a default protocol other than HTTP.
> * With {{httpSslFactory}}, HTTP REST accepts a Host header absent from the
> certificate by default. An explicit Jetty {{SecureRequestCustomizer}} keeps
> its Host check. TLS configured in Jetty XML remains outside Ignite's reload
> and status commands. Moving TLS from XML to the factory requires a rolling
> restart. [HTTPS migration
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload].
> * The node starts and stops a {{LifecycleAware}} {{httpSslFactory}} once,
> even when binary REST shares it.
> Builds on IGNITE-29210. Code and validation are in [PR
> #13787|https://github.com/apache/ignite/pull/13787]. Once both this task and
> IGNITE-29211 are present, include the [joint HTTPS renewal test and
> documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
> once in the PR merged second.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
