[
https://issues.apache.org/jira/browse/IGNITE-29210?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138496#comment-18138496
]
Anton Vinogradov commented on IGNITE-29210:
-------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13785] verdict for PR
13785 · RunAll build [9471975|https://ci2.ignite.apache.org/build/9471975] ·
tested
[6b6cb10|https://github.com/apache/ignite/pull/13785/commits/6b6cb108a00a0048f0a09c9ce77eb85617e33e8a]
· 149 suites ran, 0 reused
(/) *No blockers* — nothing in this run looks caused by this PR. 20 failing
tests are not blamed on this PR.
_What each label means and what to do: [verdict
glossary|https://github.com/anton-vinogradov/ignite-pr-checker/blob/main/docs/features.md#verdict-glossary]._
> Reload TLS certificates on running nodes
> ----------------------------------------
>
> Key: IGNITE-29210
> URL: https://issues.apache.org/jira/browse/IGNITE-29210
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h
> Remaining Estimate: 0h
>
> Administrators can rotate TLS certificates and trust stores and check the
> result on every server and client node without restarting any node. The
> commands cover discovery, communication, the client connector and binary
> REST. Both require {{ADMIN_OPS}}.
> h3. Result
> * {{control.sh --ssl reload}} reloads each factory once per node. Transports
> sharing it use the new certificates for new connections. Existing connections
> stay open. The command records the initiator and continues with other
> factories and nodes after a failure.
> * Startup and reload require a context that can create TLS engines and stream
> sockets. At first registration a node can start with a warning if the factory
> reports no X.509 chains or a certificate outside its validity period. Reload
> rejects the context already in use, a store reporting no X.509 chains and
> chains containing expired or not-yet-valid certificates. A failed reload
> keeps the previous context. Calling {{init()}} on the same factory at restart
> uses the reload checks.
> * {{control.sh --ssl status}} shows transports and aliases for each factory.
> It distinguishes a store without X.509 chains from a factory that cannot
> report its chains.
> h3. Compatibility
> Give each node its own {{AbstractSslContextFactory}} instance. Nodes sharing
> one instance switch certificates together and report the same reload result.
> Ignite calls a plain {{Factory<SSLContext>}} when its first transport
> registers and again on reload. New outgoing communication connections reuse
> that context. Previously, each new outgoing communication connection called
> the factory. On reload it must return a fresh context and supplies no chains
> for date checks. Update and recompile custom discovery SPI subclasses that
> used the removed protected fields {{sslSockFactory}} and
> {{sslSrvSockFactory}}. Configure peer trust before rotation and verify it
> with a new connection. [Rollout and
> recovery|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#upgrading-certificates].
> Builds on IGNITE-29209. Code and validation are in [PR
> #13785|https://github.com/apache/ignite/pull/13785].
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
