zzjcool commented on code in PR #238:
URL: https://github.com/apache/rocketmq-mqtt/pull/238#discussion_r1496858397
##########
mqtt-cs/src/main/java/org/apache/rocketmq/mqtt/cs/protocol/ssl/SslFactory.java:
##########
@@ -71,6 +76,55 @@ private void initSslContext() {
}
}
+ @PostConstruct
+ private void onSslCertChanged() {
+ if (!connectConf.isEnableTlsSever()) {
+ return;
+ }
+
+ String[] watchFiles = {connectConf.getSslServerCertFile(),
connectConf.getSslServerKeyFile(),
+ connectConf.getSslCaCertFile()};
+
+ FileWatchService.Listener listener = new FileWatchService.Listener() {
+
+ boolean certChanged, keyChanged = false;
+
+ @Override
+ public void onChanged(String path) {
+ if (path.equals(connectConf.getSslCaCertFile())) {
+ LOG.info("The trust certificate changed, reload the ssl
context");
+ initSslContext();
+ }
+ if (path.equals(connectConf.getSslServerCertFile())) {
+ certChanged = true;
+ }
+ if (path.equals(connectConf.getSslServerKeyFile())) {
+ keyChanged = true;
+ }
+ if (certChanged && keyChanged) {
+ LOG.info("The certificate and private key changed, reload
the ssl context");
+ certChanged = false;
+ keyChanged = false;
+ initSslContext();
+ }
+ }
+ };
+
+ try {
+ fileWatchService = new FileWatchService(watchFiles, listener);
+ fileWatchService.start();
+ } catch (Exception e) {
+ LOG.warn("FileWatchService created error, can't load the
certificate dynamically");
+ }
+ }
+
+ @PreDestroy
+ private void destroy() {
+ if (this.fileWatchService != null) {
+ this.fileWatchService.shutdown();
+ }
+ }
+
public SSLEngine buildSslEngine(SocketChannel ch) {
Review Comment:
Reloaded certificate doesn't require restarting the port listening, because
each connection will establish a SocketChannel and a new sslEngine will be
built by a reloaded sslContext.
I refer to the [RocketMQ code
NamesrvController.java#L145](https://github.com/apache/rocketmq/blob/develop/namesrv/src/main/java/org/apache/rocketmq/namesrv/NamesrvController.java#L145)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
