[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
Allow administrators to configure HTTPS for HTTP REST with an SSL context
factory and rotate its certificates and trust material on running nodes.
h3. What to deliver
# Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the built-in
connector or on a Jetty XML connector whose default protocol is HTTP and which
has no TLS of its own. Add {{httpSslClientAuth}} to require a trusted client
certificate.
# Include HTTP REST in the reload command and its results once factory-managed
HTTPS starts. A factory that does not extend {{AbstractSslContextFactory}}
supplies the startup context and is reported as unsupported. During loading and
after failure, new connections use the previous context. After success, they
use the replacement. Established connections stay open.
# Use exactly the factory's enabled protocols and cipher suites, without
Jetty's default exclusions. Keep configured Jetty Host/SNI checks. Jetty's
default Host check applies when the connector has no explicit secure request
customizer, so the host name or IP address clients use must match the server
certificate.
# Keep HTTPS configured in Jetty XML unchanged and outside the reload command
and its results. When starting HTTP REST, fail node startup without serving
plaintext HTTP if a configured factory conflicts with the connector's TLS or
non-HTTP default protocol, or if {{httpSslClientAuth}} is enabled without
{{httpSslFactory}}. Document setup and migration from XML-managed TLS with a
restart.
# Start and stop a {{LifecycleAware}} factory once per node, even when HTTP and
binary REST share it. Use the same reload and automatic renewal as the other
transports.
h3. Acceptance
Verify key and trust rotation, mutual TLS, exact protocol and cipher settings,
Host checks, failed reload, continuity of established connections, and
shared-factory lifecycle. Cover the built-in and XML connectors, unchanged
HTTPS configured in Jetty XML, and rejected configurations that never serve
plaintext HTTP. Check that only factory-managed HTTPS that started appears in
reload results.
Depends on IGNITE-29211. Include a test showing scheduled renewal on a new
HTTPS connection while an established connection remains usable. Add HTTPS to
the reload and renewal documentation from IGNITE-29210 and IGNITE-29211.
[Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
was:
Allow administrators to configure HTTPS for HTTP REST with an SSL context
factory and rotate its certificates and trust material on running nodes.
h3. What to deliver
# Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the built-in
connector or on a Jetty XML connector whose default protocol is HTTP and which
has no TLS of its own. Add {{httpSslClientAuth}} to require a trusted client
certificate.
# Include HTTP REST in the reload command and its results once factory-managed
HTTPS starts. A factory outside IGNITE-29210's reload contract supplies the
startup context and is reported as unsupported. During loading and after
failure, new connections use the previous context. After success, they use the
replacement. Established connections stay open.
# Use exactly the factory's enabled protocols and cipher suites, without
Jetty's default exclusions. Keep configured Jetty Host/SNI checks. Jetty's
default Host check applies when the connector has no explicit secure request
customizer, so the host name or IP address clients use must match the server
certificate.
# Keep TLS configured directly in Jetty XML unchanged and outside the reload
command and its results. Fail startup without serving plaintext HTTP if a
configured factory conflicts with the connector's TLS or non-HTTP default
protocol, or if {{httpSslClientAuth}} is enabled without {{httpSslFactory}}.
Document setup and migration from XML-managed TLS with a restart.
# Start and stop a {{LifecycleAware}} factory once per node, even when HTTP and
binary REST share it. Use the same reload and automatic renewal as the other
transports.
h3. Acceptance
Verify key and trust rotation, mutual TLS, exact protocol and cipher settings,
Host checks, failed reload, continuity of established connections, and
shared-factory lifecycle. Cover the built-in and XML connectors, unchanged
XML-managed HTTPS, and rejected configurations that never serve plaintext HTTP.
Check that only factory-managed HTTPS that started appears in reload results.
Depends on IGNITE-29211. Include a test showing scheduled renewal on a new
HTTPS connection while an established connection remains usable. Add the
combined manual reload and renewal documentation.
[Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
> Configure HTTPS for HTTP REST with a reloadable SSL context factory
> -------------------------------------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Allow administrators to configure HTTPS for HTTP REST with an SSL context
> factory and rotate its certificates and trust material on running nodes.
> h3. What to deliver
> # Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the
> built-in connector or on a Jetty XML connector whose default protocol is HTTP
> and which has no TLS of its own. Add {{httpSslClientAuth}} to require a
> trusted client certificate.
> # Include HTTP REST in the reload command and its results once
> factory-managed HTTPS starts. A factory that does not extend
> {{AbstractSslContextFactory}} supplies the startup context and is reported as
> unsupported. During loading and after failure, new connections use the
> previous context. After success, they use the replacement. Established
> connections stay open.
> # Use exactly the factory's enabled protocols and cipher suites, without
> Jetty's default exclusions. Keep configured Jetty Host/SNI checks. Jetty's
> default Host check applies when the connector has no explicit secure request
> customizer, so the host name or IP address clients use must match the server
> certificate.
> # Keep HTTPS configured in Jetty XML unchanged and outside the reload command
> and its results. When starting HTTP REST, fail node startup without serving
> plaintext HTTP if a configured factory conflicts with the connector's TLS or
> non-HTTP default protocol, or if {{httpSslClientAuth}} is enabled without
> {{httpSslFactory}}. Document setup and migration from XML-managed TLS with a
> restart.
> # Start and stop a {{LifecycleAware}} factory once per node, even when HTTP
> and binary REST share it. Use the same reload and automatic renewal as the
> other transports.
> h3. Acceptance
> Verify key and trust rotation, mutual TLS, exact protocol and cipher
> settings, Host checks, failed reload, continuity of established connections,
> and shared-factory lifecycle. Cover the built-in and XML connectors,
> unchanged HTTPS configured in Jetty XML, and rejected configurations that
> never serve plaintext HTTP. Check that only factory-managed HTTPS that
> started appears in reload results.
> Depends on IGNITE-29211. Include a test showing scheduled renewal on a new
> HTTPS connection while an established connection remains usable. Add HTTPS to
> the reload and renewal documentation from IGNITE-29210 and IGNITE-29211.
> [Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
