Tomas,

Thanks for pointing out that implemented solution has an issue with
reloading of certificates. It seems I missed it. I will look into fixing
that.

Operation "updateTLS"  re-creates TLS context based on current values of
keystore/trustore attributes. Though, you are right about possible usage of
old certificates/keys due to caching of data for previous
keystore/trustores . I think that it should be a responsibility of
keystore/trustore to update cached data on corresponding changes to the
attributes.I believe it would make more sense to implement it as a separate
JIRA.

Merging changes to 7.1 and releasing them as part of "bugfix" release would
be a violation of contract for Semantic Versioning [1], as implemented
changes would not make the system exactly backward compatible from
behavioural and API point of views, but, I have already broken that
contract many times on release 7.1.x versions. I am not very proud of that,
but, I think we can live with that, taking that there are not many features
on master for 8.0 release and maintaining multiple parallel releases is a
bit hard for me at the moment.

Kind Regards,
Alex

[1] https://semver.org/spec/v2.0.0.html


On Fri, 26 Jul 2019 at 09:32, .. ... <[email protected]> wrote:

> Hi Alex,
>
>
>
> thanks, this is exactly what I am looking for.
>
>
>
> I have just two comments:
>
>
>
> * it looks like there was reintroduced issue with keystore which was
> already fixed in 7.1.x branch. If there are two certificates in keystore,
> it does not matter what is set in "Certificate alias" and first certificate
> from keystore is always used.
>
>
>
> * if no parameter of keystore/truststore is changed, keystore is not
> reloaded. To add client certificate you have to change truststore filename
> as well, because otherwise truststore is not reloaded. Could it be possible
> to reload related keystore and truststore(s) during "updateTLS" operation
> everytime?
>
>
>
> Jira QPID-8306 is still in open state, should I raise JIRA for these two
> comments or it can be implemented in QPID-8306.
>
>
>
> Qpid Broker-J version - master - last commit
> bf75f490170beb91f72547c00c365bf024cbaa1f
>
>
>
> Regards,
> Tomas
>

Reply via email to