Anton Vinogradov created IGNITE-29209:
-----------------------------------------
Summary: Add fresh SSL contexts with certificate metadata
Key: IGNITE-29209
URL: https://issues.apache.org/jira/browse/IGNITE-29209
Project: Ignite
Issue Type: Sub-task
Reporter: Anton Vinogradov
Assignee: Anton Vinogradov
Certificate reload needs a fresh SSLContext and metadata that describes the
exact key material loaded into it. Reading the key store again for metadata
could report a different certificate if the source changes between reads.
Add AbstractSslContextFactory.createNew() while preserving the existing cached
create() behavior. Introduce KeyMaterial and a compatible createKeyMaterial()
hook that obtains key managers and their certificate chain from one load.
Existing subclasses using createKeyManagers() and createTrustManagers() must
continue to work. SslContextFactory should obtain its metadata from the store
already used to initialize its key managers.
Extend SSLContextWrapper to carry the chain and distinguish material known to
contain no private key from material whose chain is unknown. Preserve the
existing constructor, defensively copy metadata, and retain metadata when
wrapping an existing wrapper. A wrapper carrying metadata alone must preserve
delegate behavior without requiring custom SSLParameters.
Tests should cover cached versus fresh creation, one-load consistency, legacy
hooks, defensive copies, wrapper behavior, and stores with zero, one, or
multiple private keys. Document the extension contracts in Javadoc, including
subclasses that override create(). Keep renewal settings and node reload
behavior in their respective follow-up tasks.
Planned merge order: after IGNITE-29208. There is no functional dependency on
that fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
