[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
Allow administrators to configure HTTPS for HTTP REST with an SSL context
factory and rotate its certificates and trust material on running nodes.
h3. What to deliver
# Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the built-in
connector or on a Jetty XML connector whose default protocol is HTTP and which
has no TLS of its own. Add {{httpSslClientAuth}} to require a trusted client
certificate.
# Include HTTP REST in the reload command and its results once factory-managed
HTTPS starts. A factory outside IGNITE-29210's reload contract supplies the
startup context and is reported as unsupported. During loading and after
failure, new connections use the previous context. After success, they use the
replacement. Established connections stay open.
# Use exactly the factory's enabled protocols and cipher suites, without
Jetty's default exclusions. Keep configured Jetty Host/SNI checks. Jetty's
default Host check applies when the connector has no explicit secure request
customizer, so the host name or IP address clients use must match the server
certificate.
# Keep TLS configured directly in Jetty XML unchanged and outside the reload
command and its results. Fail startup without serving plaintext HTTP if a
configured factory conflicts with the connector's TLS or non-HTTP default
protocol, or if {{httpSslClientAuth}} is enabled without {{httpSslFactory}}.
Document setup and migration from XML-managed TLS with a restart.
# Start and stop a {{LifecycleAware}} factory once per node, even when HTTP and
binary REST share it. Use the same reload and automatic renewal as the other
transports.
h3. Acceptance
Verify key and trust rotation, mutual TLS, exact protocol and cipher settings,
Host checks, failed reload, continuity of established connections, and
shared-factory lifecycle. Cover the built-in and XML connectors, unchanged
XML-managed HTTPS, and rejected configurations that never serve plaintext HTTP.
Check that only factory-managed HTTPS that started appears in reload results.
Depends on IGNITE-29211. Include a test showing scheduled renewal on a new
HTTPS connection while an established connection remains usable. Add the
combined manual reload and renewal documentation.
[Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
was:
Extend manual TLS reload to HTTPS so HTTP REST certificates and trust can be
replaced without restarting nodes.
h3. What to deliver
# Allow factory-managed HTTPS on the built-in HTTP connector and compatible
HTTP connectors defined in Jetty XML. Include HTTP REST in the reload command
and its results, using IGNITE-29210's factory support rules.
# Apply replacements to new connections, preserve established connections and
retain the previous context after failed loading.
# Support requiring a trusted client certificate. Preserve configured Jetty
protocol, cipher and Host/SNI checks.
# Keep existing XML-managed HTTPS unchanged and outside the reload command.
Reject conflicting TLS configuration without falling back to plaintext;
document migration and its restart requirement.
# Start, stop and reload a shared factory once per node, including when HTTP
and binary REST share it.
h3. Acceptance
Verify key/trust rotation, mutual TLS, established connections, failures,
shared lifecycle and both connector configuration paths.
Depends on IGNITE-29210. Can merge independently of IGNITE-29211. Whichever
merges second must verify scheduled HTTPS rotation, established-connection
continuity and the combined documentation. No separate status command or new
renewal mechanism.
[Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
Summary: Configure HTTPS for HTTP REST with a reloadable SSL context
factory (was: Support certificate reload for HTTP REST)
> Configure HTTPS for HTTP REST with a reloadable SSL context factory
> -------------------------------------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Allow administrators to configure HTTPS for HTTP REST with an SSL context
> factory and rotate its certificates and trust material on running nodes.
> h3. What to deliver
> # Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the
> built-in connector or on a Jetty XML connector whose default protocol is HTTP
> and which has no TLS of its own. Add {{httpSslClientAuth}} to require a
> trusted client certificate.
> # Include HTTP REST in the reload command and its results once
> factory-managed HTTPS starts. A factory outside IGNITE-29210's reload
> contract supplies the startup context and is reported as unsupported. During
> loading and after failure, new connections use the previous context. After
> success, they use the replacement. Established connections stay open.
> # Use exactly the factory's enabled protocols and cipher suites, without
> Jetty's default exclusions. Keep configured Jetty Host/SNI checks. Jetty's
> default Host check applies when the connector has no explicit secure request
> customizer, so the host name or IP address clients use must match the server
> certificate.
> # Keep TLS configured directly in Jetty XML unchanged and outside the reload
> command and its results. Fail startup without serving plaintext HTTP if a
> configured factory conflicts with the connector's TLS or non-HTTP default
> protocol, or if {{httpSslClientAuth}} is enabled without {{httpSslFactory}}.
> Document setup and migration from XML-managed TLS with a restart.
> # Start and stop a {{LifecycleAware}} factory once per node, even when HTTP
> and binary REST share it. Use the same reload and automatic renewal as the
> other transports.
> h3. Acceptance
> Verify key and trust rotation, mutual TLS, exact protocol and cipher
> settings, Host checks, failed reload, continuity of established connections,
> and shared-factory lifecycle. Cover the built-in and XML connectors,
> unchanged XML-managed HTTPS, and rejected configurations that never serve
> plaintext HTTP. Check that only factory-managed HTTPS that started appears in
> reload results.
> Depends on IGNITE-29211. Include a test showing scheduled renewal on a new
> HTTPS connection while an established connection remains usable. Add the
> combined manual reload and renewal documentation.
> [Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
