[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
With {{ConnectorConfiguration.httpSslFactory}}, {{control.sh --ssl reload}}
loads new certificates and trust stores for HTTP REST. New HTTPS connections
use the new certificates. Established connections stay open, and a failed
reload keeps the existing material.
{{--ssl status}} lists them under HTTP REST.
h3. Result
* Support the built-in HTTP connector and connectors from Jetty XML. Jetty
applies its default exclusions to the factory's protocols and cipher suites.
With {{httpSslClientAuth=true}}, new connections require a trusted client
certificate.
* A node running HTTP REST fails to start if {{httpSslClientAuth}} is enabled
without {{httpSslFactory}}, or if a connector using that factory already
configures TLS or a default protocol other than HTTP.
* With {{httpSslFactory}}, HTTP REST accepts a Host header absent from the
certificate by default. An explicit Jetty {{SecureRequestCustomizer}} keeps its
Host check. TLS configured in Jetty XML remains outside Ignite's reload and
status commands. Moving TLS from XML to the factory requires a rolling restart.
[HTTPS migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload].
* The node starts and stops a {{LifecycleAware}} {{httpSslFactory}} once, even
when binary REST shares it.
Builds on IGNITE-29210. Code and validation are in [PR
#13787|https://github.com/apache/ignite/pull/13787]. Once both this task and
IGNITE-29211 are present, include the [joint HTTPS renewal test and
documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
once in the PR merged second.
was:
With {{ConnectorConfiguration.httpSslFactory}}, {{control.sh --ssl reload}}
loads new certificates and trust stores for HTTP REST. {{--ssl status}} lists
them under HTTP REST. New HTTPS connections use the new certificates.
Established connections stay open, and a failed reload keeps the existing
material.
h3. Result
* Support the built-in HTTP connector and connectors from Jetty XML. Jetty
applies its default exclusions to the factory's protocols and cipher suites.
With {{httpSslClientAuth=true}}, new connections require a trusted client
certificate.
* A node running HTTP REST fails to start if {{httpSslClientAuth}} is enabled
without {{httpSslFactory}}, or if a connector using that factory already
configures TLS or a default protocol other than HTTP.
* With {{httpSslFactory}}, HTTP REST accepts a Host header absent from the
certificate by default. An explicit Jetty {{SecureRequestCustomizer}} keeps its
Host check. TLS configured in Jetty XML remains outside Ignite's reload and
status commands. Moving TLS from XML to the factory requires a rolling restart.
[HTTPS migration
guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload].
* The node starts and stops a {{LifecycleAware}} {{httpSslFactory}} once, even
when binary REST shares it.
Builds on IGNITE-29210. Code and validation are in [PR
#13787|https://github.com/apache/ignite/pull/13787]. Once both this task and
IGNITE-29211 are present, include the [joint HTTPS renewal test and
documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
once in the PR merged second.
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 40m
> Remaining Estimate: 0h
>
> With {{ConnectorConfiguration.httpSslFactory}}, {{control.sh --ssl reload}}
> loads new certificates and trust stores for HTTP REST. New HTTPS connections
> use the new certificates. Established connections stay open, and a failed
> reload keeps the existing material.
> {{--ssl status}} lists them under HTTP REST.
> h3. Result
> * Support the built-in HTTP connector and connectors from Jetty XML. Jetty
> applies its default exclusions to the factory's protocols and cipher suites.
> With {{httpSslClientAuth=true}}, new connections require a trusted client
> certificate.
> * A node running HTTP REST fails to start if {{httpSslClientAuth}} is enabled
> without {{httpSslFactory}}, or if a connector using that factory already
> configures TLS or a default protocol other than HTTP.
> * With {{httpSslFactory}}, HTTP REST accepts a Host header absent from the
> certificate by default. An explicit Jetty {{SecureRequestCustomizer}} keeps
> its Host check. TLS configured in Jetty XML remains outside Ignite's reload
> and status commands. Moving TLS from XML to the factory requires a rolling
> restart. [HTTPS migration
> guide|https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload].
> * The node starts and stops a {{LifecycleAware}} {{httpSslFactory}} once,
> even when binary REST shares it.
> Builds on IGNITE-29210. Code and validation are in [PR
> #13787|https://github.com/apache/ignite/pull/13787]. Once both this task and
> IGNITE-29211 are present, include the [joint HTTPS renewal test and
> documentation|https://github.com/anton-vinogradov/ignite/commit/34c84b8dee8043b33878b2510c8f8321afd25694]
> once in the PR merged second.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
