[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
Let administrators use an SSL context factory for HTTPS on HTTP REST. They can
then replace certificates and trust on running nodes.
h3. Configuration
# Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the built-in
connector. It also works on a Jetty XML connector that uses HTTP as its default
protocol and has no TLS of its own. Add {{httpSslClientAuth}} to require a
trusted client certificate.
# Use the factory's exact set of enabled protocols and cipher suites. Jetty's
default exclusions do not apply to this connector. Keep configured Jetty Host
and SNI checks. Without an explicit secure request customizer, Jetty checks the
Host against the server certificate. The host name or IP address that clients
use must match.
# Keep HTTPS configured directly in Jetty XML as it is and leave it out of
reload and its results. When HTTP REST starts, reject a configured factory if
the connector already defines TLS or has a default protocol other than HTTP.
Also reject {{httpSslClientAuth}} without {{httpSslFactory}}. Fail node startup
before the HTTP connector serves plaintext.
# Document HTTPS setup and how to move from TLS configured directly in Jetty
XML. The move requires a restart.
h3. Reload and renewal
# Include HTTP REST in the reload command and results once factory-managed
HTTPS starts. A factory that does not extend {{AbstractSslContextFactory}}
supplies the startup context. The command reports it as unsupported.
# During loading and after a failed load, new connections use the previous
context. After success, new connections use the replacement. Established
connections stay open.
# Start and stop a {{LifecycleAware}} factory once per node, even when HTTP and
binary REST share it. Use the same reload and automatic renewal as the other
transports.
h3. Acceptance
Verify key and trust rotation, mutual TLS, exact protocol and cipher settings,
Host checks, failed reload, established connections and shared-factory
lifecycle. Test the built-in connector and the XML connector. Check that HTTPS
configured directly in Jetty XML keeps working as before, rejected
configurations never serve plaintext HTTP, and reload lists only
factory-managed HTTPS that started.
Depends on IGNITE-29211. Include a test that shows scheduled renewal on a new
HTTPS connection while an established connection stays usable. Add HTTPS to the
reload and renewal documentation from IGNITE-29210 and IGNITE-29211.
[Implementation plan in PR #13787|https://github.com/apache/ignite/pull/13787]
was:
Allow administrators to configure HTTPS for HTTP REST with an SSL context
factory and rotate its certificates and trust material on running nodes.
h3. What to deliver
# Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the built-in
connector or on a Jetty XML connector whose default protocol is HTTP and which
has no TLS of its own. Add {{httpSslClientAuth}} to require a trusted client
certificate.
# Include HTTP REST in the reload command and its results once factory-managed
HTTPS starts. A factory that does not extend {{AbstractSslContextFactory}}
supplies the startup context and is reported as unsupported. During loading and
after failure, new connections use the previous context. After success, they
use the replacement. Established connections stay open.
# Use exactly the factory's enabled protocols and cipher suites, without
Jetty's default exclusions. Keep configured Jetty Host/SNI checks. Jetty's
default Host check applies when the connector has no explicit secure request
customizer, so the host name or IP address clients use must match the server
certificate.
# Keep HTTPS configured in Jetty XML unchanged and outside the reload command
and its results. When starting HTTP REST, fail node startup without serving
plaintext HTTP if a configured factory conflicts with the connector's TLS or
non-HTTP default protocol, or if {{httpSslClientAuth}} is enabled without
{{httpSslFactory}}. Document setup and migration from XML-managed TLS with a
restart.
# Start and stop a {{LifecycleAware}} factory once per node, even when HTTP and
binary REST share it. Use the same reload and automatic renewal as the other
transports.
h3. Acceptance
Verify key and trust rotation, mutual TLS, exact protocol and cipher settings,
Host checks, failed reload, continuity of established connections, and
shared-factory lifecycle. Cover the built-in and XML connectors, unchanged
HTTPS configured in Jetty XML, and rejected configurations that never serve
plaintext HTTP. Check that only factory-managed HTTPS that started appears in
reload results.
Depends on IGNITE-29211. Include a test showing scheduled renewal on a new
HTTPS connection while an established connection remains usable. Add HTTPS to
the reload and renewal documentation from IGNITE-29210 and IGNITE-29211.
[Implementation plan: PR #13787|https://github.com/apache/ignite/pull/13787]
> Configure HTTPS for HTTP REST with a reloadable SSL context factory
> -------------------------------------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Let administrators use an SSL context factory for HTTPS on HTTP REST. They
> can then replace certificates and trust on running nodes.
> h3. Configuration
> # Add {{ConnectorConfiguration.httpSslFactory}} to enable HTTPS on the
> built-in connector. It also works on a Jetty XML connector that uses HTTP as
> its default protocol and has no TLS of its own. Add {{httpSslClientAuth}} to
> require a trusted client certificate.
> # Use the factory's exact set of enabled protocols and cipher suites. Jetty's
> default exclusions do not apply to this connector. Keep configured Jetty Host
> and SNI checks. Without an explicit secure request customizer, Jetty checks
> the Host against the server certificate. The host name or IP address that
> clients use must match.
> # Keep HTTPS configured directly in Jetty XML as it is and leave it out of
> reload and its results. When HTTP REST starts, reject a configured factory if
> the connector already defines TLS or has a default protocol other than HTTP.
> Also reject {{httpSslClientAuth}} without {{httpSslFactory}}. Fail node
> startup before the HTTP connector serves plaintext.
> # Document HTTPS setup and how to move from TLS configured directly in Jetty
> XML. The move requires a restart.
> h3. Reload and renewal
> # Include HTTP REST in the reload command and results once factory-managed
> HTTPS starts. A factory that does not extend {{AbstractSslContextFactory}}
> supplies the startup context. The command reports it as unsupported.
> # During loading and after a failed load, new connections use the previous
> context. After success, new connections use the replacement. Established
> connections stay open.
> # Start and stop a {{LifecycleAware}} factory once per node, even when HTTP
> and binary REST share it. Use the same reload and automatic renewal as the
> other transports.
> h3. Acceptance
> Verify key and trust rotation, mutual TLS, exact protocol and cipher
> settings, Host checks, failed reload, established connections and
> shared-factory lifecycle. Test the built-in connector and the XML connector.
> Check that HTTPS configured directly in Jetty XML keeps working as before,
> rejected configurations never serve plaintext HTTP, and reload lists only
> factory-managed HTTPS that started.
> Depends on IGNITE-29211. Include a test that shows scheduled renewal on a new
> HTTPS connection while an established connection stays usable. Add HTTPS to
> the reload and renewal documentation from IGNITE-29210 and IGNITE-29211.
> [Implementation plan in PR #13787|https://github.com/apache/ignite/pull/13787]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
