[
https://issues.apache.org/jira/browse/IGNITE-28867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097506#comment-18097506
]
Anton Vinogradov edited comment on IGNITE-28867 at 7/20/26 8:33 AM:
--------------------------------------------------------------------
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13335] verdict for PR
13335 · RunAll build [9215889|https://ci2.ignite.apache.org/build/9215889] ·
147 suites ran, 0 reused
(?) *1 suite(s) ran fewer tests than on master* (tests that never ran can't
fail):
- Thin Client: Java: 57 tests vs 439 on master (*-87%*)
(/) No test blockers otherwise; 26 pre-existing/flaky filtered out.
♻️ Settled after 1 auto re-run wave(s): #1 — 1 broken suite(s).
was (Author: av):
[Ignite PR Checker|https://ignite-pr-checker.is-a.dev/?pr=13335] verdict for PR
13335 · RunAll build [9215889|https://ci2.ignite.apache.org/build/9215889] ·
147 suites ran, 0 reused
(!) *1 broken suite(s)* (failed without a reliable run):
- Thin Client: Java: non-zero exit code · Number of tests 57 is 87% less than
439 in build #17561
(?) *1 suite(s) ran fewer tests than on master* (tests that never ran can't
fail):
- Thin Client: Java: 57 tests vs 439 on master (*-87%*)
(/) No test blockers otherwise; 26 pre-existing/flaky filtered out.
⏳ _Auto re-run *#1* in progress — 1 broken suite(s) re-queued (attempt 1/2), *≈
settled by 11:26 MSK*. This comment updates when they settle._
> Implement TLS certificate hot redeployment via control.sh --ssl reload
> ----------------------------------------------------------------------
>
> Key: IGNITE-28867
> URL: https://issues.apache.org/jira/browse/IGNITE-28867
> Project: Ignite
> Issue Type: Task
> Reporter: Mikhail Petrov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Fix For: 2.19
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> Currently, Ignite node TLS certificates are loaded only once during node
> startup and then used to establish secure connections between `node to node`,
> `node to thin client`. As a result, updating a certificate requires
> restarting the Ignite node, causing unnecessary downtime and requiring
> additional administrative effort.
> We need to implement hot redeployment of TLS certificates, allowing the
> Ignite node to reload the certificates at runtime without requiring a node
> restart. Existing TLS sessions should remain unaffected, while all new TLS
> handshakes should use the updated credentials.
> Basic Steps
> 1. Introduce a mechanism to trigger certificate reloading (for example,
> through `control.sh`).
> 2. Create a new `SslContext` instance by invoking `SslContextFactory`.
> 3. Replace the active `SslContext` used for TLS connection establishment. All
> newly established connections must use the updated certificates, while
> existing connections will continue to operate without interruption.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
