[
https://issues.apache.org/jira/browse/IGNITE-29212?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29212:
--------------------------------------
Description:
HTTP REST certificates configured in Jetty XML currently require a node restart
to replace. Add {{ConnectorConfiguration.httpSslFactory}} and
{{httpSslClientAuth}} so HTTPS can use the node's managed SSL context and
participate in reload and status.
h3. Required behavior
* Support the built-in Jetty connector and HTTP connectors supplied through
Jetty XML. Preserve the factory's protocols and cipher suites, Jetty's
applicable cipher exclusions and existing SecureRequestCustomizer settings.
* Refuse startup if httpSslFactory is combined with a connector's own TLS or
the PROXY protocol. Also refuse httpSslClientAuth=true without httpSslFactory.
* Keep existing Jetty XML TLS configurations working unchanged when
httpSslFactory is not configured.
* Use the new context for new HTTPS connections and keep existing connections
usable. A failed reload must retain the working context.
* Keep client authentication enforced after certificate and trust-store changes.
h3. Tests and documentation
Cover certificate reload, existing connections, failed replacement, mutual TLS,
trust-store changes, supported XML connectors, configuration errors and legacy
XML compatibility. Check both the factory's allowed cipher suites and the
suites excluded by Jetty, before and after reload.
Explain migration from Jetty XML: key-store requirements, protocols and cipher
suites, client authentication, customizers that must be preserved, the required
restart and verification with the application's host names and certificates.
h3. Dependencies and remaining work
The branch {{ignite-29212}} is prepared. Open its PR after IGNITE-29210 is
merged, then run CI on the updated branch. Keep this integration independent of
automatic renewal in IGNITE-29211.
When both IGNITE-29211 and IGNITE-29212 are present, verify HTTPS with
automatic renewal and document it in the renewal configuration table, HTTP REST
guide and ConnectorConfiguration Javadoc. Include the combined documentation
with whichever change merges second.
was:
HTTP REST certificates configured directly in Jetty XML currently require a
node restart to replace. Add ConnectorConfiguration.httpSslFactory and
httpSslClientAuth so HTTPS can use the node's managed SSL context and
participate in certificate reload and status. The same integration should allow
automatic renewal when it is enabled on the factory.
Apply the factory to the built-in Jetty connector and supported connectors
supplied through Jetty XML. Preserve the factory's protocols and cipher suites,
Jetty's applicable cipher exclusions, and existing SecureRequestCustomizer
settings. Reject configurations that combine httpSslFactory with a connector's
own TLS or with the PROXY protocol, and reject httpSslClientAuth=true without
httpSslFactory. Existing Jetty XML TLS configurations must continue to work
unchanged when the new factory is not configured.
New HTTPS connections must use the replaced context while existing connections
remain usable. A failed reload must retain the working context, and client
authentication must remain enforced after certificate and trust-store changes.
Include tests for these behaviors, supported XML connectors, configuration
errors, and legacy XML compatibility. Add migration instructions covering
key-store requirements, protocols and ciphers, client authentication, preserved
customizers, restart steps, and verification with application host names and
certificates.
Depends on IGNITE-29210. Keep this integration independent of the
automatic-renewal implementation in IGNITE-29211.
> Support certificate reload for HTTP REST
> ----------------------------------------
>
> Key: IGNITE-29212
> URL: https://issues.apache.org/jira/browse/IGNITE-29212
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
>
> HTTP REST certificates configured in Jetty XML currently require a node
> restart to replace. Add {{ConnectorConfiguration.httpSslFactory}} and
> {{httpSslClientAuth}} so HTTPS can use the node's managed SSL context and
> participate in reload and status.
> h3. Required behavior
> * Support the built-in Jetty connector and HTTP connectors supplied through
> Jetty XML. Preserve the factory's protocols and cipher suites, Jetty's
> applicable cipher exclusions and existing SecureRequestCustomizer settings.
> * Refuse startup if httpSslFactory is combined with a connector's own TLS or
> the PROXY protocol. Also refuse httpSslClientAuth=true without httpSslFactory.
> * Keep existing Jetty XML TLS configurations working unchanged when
> httpSslFactory is not configured.
> * Use the new context for new HTTPS connections and keep existing connections
> usable. A failed reload must retain the working context.
> * Keep client authentication enforced after certificate and trust-store
> changes.
> h3. Tests and documentation
> Cover certificate reload, existing connections, failed replacement, mutual
> TLS, trust-store changes, supported XML connectors, configuration errors and
> legacy XML compatibility. Check both the factory's allowed cipher suites and
> the suites excluded by Jetty, before and after reload.
> Explain migration from Jetty XML: key-store requirements, protocols and
> cipher suites, client authentication, customizers that must be preserved, the
> required restart and verification with the application's host names and
> certificates.
> h3. Dependencies and remaining work
> The branch {{ignite-29212}} is prepared. Open its PR after IGNITE-29210 is
> merged, then run CI on the updated branch. Keep this integration independent
> of automatic renewal in IGNITE-29211.
> When both IGNITE-29211 and IGNITE-29212 are present, verify HTTPS with
> automatic renewal and document it in the renewal configuration table, HTTP
> REST guide and ConnectorConfiguration Javadoc. Include the combined
> documentation with whichever change merges second.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
