[
https://issues.apache.org/jira/browse/GEODE-5338?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Alexander Murmann updated GEODE-5338:
-------------------------------------
Fix Version/s: (was: 1.8.0)
1.9.0
> Geode client to support Trust and Keystore rotation
> ---------------------------------------------------
>
> Key: GEODE-5338
> URL: https://issues.apache.org/jira/browse/GEODE-5338
> Project: Geode
> Issue Type: Improvement
> Components: docs, security
> Reporter: Pulkit Chandra
> Assignee: Sai Boorlagadda
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.9.0
>
> Time Spent: 4h 20m
> Remaining Estimate: 0h
>
> WHY: Cloud Foundry provides ability to rotate certs pretty frequently. By
> default the certs are rotated every day and change be changed to rotate every
> hour. Which creates a issue with Java applications. This rotation is
> essential to provide a strong security stance on client applications.
> WHAT: Today Geode client applications, when establishing a TLS connection to
> the servers requires a path to the certificate, since these files would be
> changing we need a mechanism in Geode which will watch for these changes and
> use the new certs without causing service disruption.
>
> Solution options:
> Some options to consider
> # Cloud Foundry has a lib which watches for changes to these certs (which
> are in pem format)and converts them and creates inmemory objects of
> TrustStore and KeyStore. If we have a mechanism in Geode to pass these
> objects instead of path to them, we might have a solution. Also, these
> objects gets updates after rotation so the geode code needs to consider that
> as well.
> # Geode can develop its own capability to watch for change on the files and
> convert them to right format using OpenSSL and create files and pass them in.
> Update these file everytime someone updates the certs
> # Geode starts accepting pem files and watches them directly for changes.
>
> Key Outcomes to watch for:
> 1. Provide ability to rotate cert easily without downtime.
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
