fapifta commented on code in PR #5064:
URL: https://github.com/apache/ozone/pull/5064#discussion_r1282817609
##########
hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/security/RootCARotationManager.java:
##########
@@ -710,4 +761,52 @@ public boolean shouldSkipRootCert(String newRootCertId)
throws IOException {
}
return false;
}
+
+ private void checkAndHandlePostProcessing() throws IOException,
+ CertificateException {
+ CertInfoProto proto = readConfiguration(CertInfoProto.class);
+ if (proto == null) {
+ LOG.info("No {} configuration found in stateful storage",
+ getServiceName());
+ return;
+ }
+
+ X509Certificate cert =
+ CertificateCodec.getX509Certificate(proto.getX509Certificate());
+
+ List<X509Certificate> scmCertChain = scmCertClient.getTrustChain();
+ Preconditions.checkArgument(scmCertChain.size() > 1);
+ X509Certificate rootCert = scmCertChain.get(scmCertChain.size() - 1);
+
+ int result = rootCert.getSerialNumber().compareTo(cert.getSerialNumber());
+ if (result > 0) {
+ // this could happen if the previous stateful configuration is not
deleted
+ LOG.warn("Root CA certificate ID {} in stateful storage is smaller than"
+
+ " current scm's root certificate ID {}", cert.getSerialNumber(),
+ rootCert.getSerialNumber());
+
+ deleteConfiguration();
+ LOG.warn("Stateful configuration is deleted");
+ return;
+ } else if (result < 0) {
+ // this should not happen
+ throw new RuntimeException("Root CA certificate ID " +
+ cert.getSerialNumber() + " in stateful storage is bigger than " +
+ "current scm's root CA certificate ID " +
rootCert.getSerialNumber());
+ }
+
+ Date issueTime = rootCert.getNotBefore();
+ Date now = Calendar.getInstance().getTime();
+ Duration gap = Duration.between(issueTime.toInstant(), now.toInstant());
+ gap = gap.minus(rootCertPollInterval);
Review Comment:
I see, I am fine with this approach, thank you for clarifying.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
