anton-vinogradov opened a new pull request, #13786: URL: https://github.com/apache/ignite/pull/13786
[IGNITE-29211](https://issues.apache.org/jira/browse/IGNITE-29211) With `renewalEnabled=true`, a node reloads certificates supplied by an external issuer before the earliest certificate in any reported X.509 chain expires, including a CA certificate. It installs the replacement only when every reported certificate is within its validity period and that earliest expiry moves forward. Otherwise it keeps the current context and retries. `control.sh --ssl status` shows the next attempt. Renewal is off by default and requires at least one reported chain. Operators can still use manual reload for immediate rotation or trust store changes. This PR targets `master` and includes the manual reload foundation (#13785). [Review the renewal changes alone](https://github.com/anton-vinogradov/ignite/compare/ignite-29210...ignite-29211). Renewal and [HTTP REST reload](https://issues.apache.org/jira/browse/IGNITE-29212) can merge in either order. The second PR should pick up the [four-file HTTPS renewal test and documentation change](https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599) once both features are present. Local validation at `a4bd1b1c` passed Checkstyle and all 35 renewal and node lifecycle tests, including keystore replacement, retry and shutdown. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
