anton-vinogradov opened a new pull request, #13787: URL: https://github.com/apache/ignite/pull/13787
[IGNITE-29212](https://issues.apache.org/jira/browse/IGNITE-29212) Set `ConnectorConfiguration.httpSslFactory` to rotate certificates and trust for HTTP REST with `control.sh --ssl reload`. New HTTPS connections use the replacement material, while established connections remain open. Set `httpSslClientAuth` to require a trusted client certificate. Existing Jetty XML configurations keep their TLS behavior unless an operator opts in. Moving TLS to the Ignite factory requires a restart. The [migration guide](https://github.com/anton-vinogradov/ignite/blob/ignite-29212/docs/_docs/restapi.adoc#https-and-certificate-reload) covers client authentication, alias selection, revocation checks and host checks. This PR targets `master` and includes the manual reload foundation (#13785). [Review the HTTP changes alone](https://github.com/anton-vinogradov/ignite/compare/ignite-29210...ignite-29212). Manual HTTPS reload works independently of [automatic renewal](https://issues.apache.org/jira/browse/IGNITE-29211). The second PR to merge should pick up the [four-file HTTPS renewal test and documentation change](https://github.com/anton-vinogradov/ignite/commit/889a3fde5349850cc29428f0511bc51f42a6d599) once both features are present. Local validation at `271ff0ed` passed Checkstyle and all nine Jetty tests, including certificate rotation over HTTPS, mutual TLS and connector configuration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
