[
https://issues.apache.org/jira/browse/IGNITE-29209?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Anton Vinogradov updated IGNITE-29209:
--------------------------------------
Description:
Keep each SSL context with the certificate chains from the same key-store read.
This lets a factory subclass that needs a fresh certificate at startup read the
certificate chain and initialize TLS from the same load. IGNITE-29210 uses the
same snapshot for reload and status, and IGNITE-29211 uses its expiry dates for
renewal.
h3. Result and acceptance
* A subclass can call protected {{init()}} to load a fresh bundle, including on
an embedded node restart with the same factory. After validating that its
context can create an engine, the factory publishes and returns that bundle. A
failed attempt keeps the previous material and can be retried.
* {{create()}} initializes once, including concurrent first calls, and returns
the accepted context. Repeated calls reuse the context. Serialization keeps the
configuration and drops runtime contexts.
* Obtain the context again after successful {{init()}}. Previously obtained
contexts, engines, socket factories and sockets retain their material. Reusing
a factory on restart keeps its material until the subclass reloads it.
* Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
metadata and an empty chain map are distinct. Metadata describes loaded
material, not the certificate selected for a connection.
h3. Compatibility
Affected subclasses must be updated and recompiled: {{create()}} becomes final;
the protected {{sslCtx}} field and {{createKeyManagers()}} hook are removed.
Implement the protected {{createSslBundle()}} hook, which may throw
{{SSLException}}. Store-backed implementations load once and use
{{createSslBundle(store, keyPassword, algorithm)}}. See the [migration
reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
Rename any no-argument {{init()}} method declared by your subclass. Direct
subclasses of {{AbstractSslContextFactory}} that retain {{checkParameters()}}
must remove its {{@Override}} and call it from {{createSslBundle()}};
subclasses of {{SslContextFactory}} can keep that override.
Plain {{Factory<SSLContext>}} remains supported. Empty stores support clients
without private keys; loaded stores must remain unchanged while their contexts
are in use. Unsupported TLS names fail first initialization. Certificate-date
and empty-chain replacement policies belong to IGNITE-29210.
h3. Delivery and validation
[PR #13751|https://github.com/apache/ignite/pull/13751] contains this change.
At {{c20c22e5}}, all 13 metadata tests, Checkstyle and Javadoc/doclint passed.
A local TLS handshake check verified that restarting with the same factory can
reload a new certificate and keep the last working context after a failure.
was:
Keep an SSL context and its certificate metadata from the same key-store read.
Applications explicitly replace the accepted material and obtain its new
context from the factory. IGNITE-29210 uses this snapshot for reload validation
and status; IGNITE-29211 uses its expiry dates for renewal.
h3. Result and acceptance
* {{init()}} prepares a fresh bundle, verifies that its context can create an
engine, then publishes context and metadata together. Failure retains the
previous bundle; a failed first attempt can be retried.
* {{create()}} initializes once, including concurrent first calls, and returns
the accepted context. {{sslBundle()}} returns its snapshot. Repeated reads do
not reload stores; serialization keeps configuration rather than runtime
contexts.
* Obtain the context again after successful {{init()}}. Previously obtained
contexts, engines, socket factories and sockets retain their material. An
initialized factory reused across node restarts retains its material until
{{init()}}.
* Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
metadata and an empty chain map are distinct. Metadata describes loaded
material, not the certificate selected for a connection.
h3. Compatibility
Affected subclasses must be updated and recompiled: {{create()}} becomes final;
the protected {{sslCtx}} field and {{createKeyManagers()}} hook are removed.
Implement the protected {{createSslBundle()}} hook, which may throw
{{SSLException}}. Store-backed implementations load once and use
{{createSslBundle(store, keyPassword, algorithm)}}. See the [factory
contracts|https://github.com/anton-vinogradov/ignite/blob/ignite-29209/modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java#L127]
and [migration
reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
Direct subclasses of {{AbstractSslContextFactory}} that retain
{{checkParameters()}} must remove its {{@Override}} and call it from
{{createSslBundle()}}; subclasses of {{SslContextFactory}} can keep that
override.
Plain {{Factory<SSLContext>}} remains supported. Empty stores support clients
without private keys; loaded stores must remain unchanged while their contexts
are in use. Unsupported TLS names fail first initialization. Certificate-date
and empty-chain replacement policies belong to IGNITE-29210.
h3. Delivery and validation
[PR #13751|https://github.com/apache/ignite/pull/13751] contains this API
change. At {{06489a85}}, all 18 selected API, wrapper and startup cases passed,
as did Checkstyle and Javadoc/doclint; CLI test sources compiled. These are
targeted local checks, not full CI.
> Add SSL bundle metadata and explicit factory initialization
> -----------------------------------------------------------
>
> Key: IGNITE-29209
> URL: https://issues.apache.org/jira/browse/IGNITE-29209
> Project: Ignite
> Issue Type: Sub-task
> Reporter: Anton Vinogradov
> Assignee: Anton Vinogradov
> Priority: Major
> Labels: ise
> Time Spent: 4h 10m
> Remaining Estimate: 0h
>
> Keep each SSL context with the certificate chains from the same key-store
> read. This lets a factory subclass that needs a fresh certificate at startup
> read the certificate chain and initialize TLS from the same load.
> IGNITE-29210 uses the same snapshot for reload and status, and IGNITE-29211
> uses its expiry dates for renewal.
> h3. Result and acceptance
> * A subclass can call protected {{init()}} to load a fresh bundle, including
> on an embedded node restart with the same factory. After validating that its
> context can create an engine, the factory publishes and returns that bundle.
> A failed attempt keeps the previous material and can be retried.
> * {{create()}} initializes once, including concurrent first calls, and
> returns the accepted context. Repeated calls reuse the context. Serialization
> keeps the configuration and drops runtime contexts.
> * Obtain the context again after successful {{init()}}. Previously obtained
> contexts, engines, socket factories and sockets retain their material.
> Reusing a factory on restart keeps its material until the subclass reloads it.
> * Metadata contains immutable, nonempty X.509 chains of key entries. Unknown
> metadata and an empty chain map are distinct. Metadata describes loaded
> material, not the certificate selected for a connection.
> h3. Compatibility
> Affected subclasses must be updated and recompiled: {{create()}} becomes
> final; the protected {{sslCtx}} field and {{createKeyManagers()}} hook are
> removed. Implement the protected {{createSslBundle()}} hook, which may throw
> {{SSLException}}. Store-backed implementations load once and use
> {{createSslBundle(store, keyPassword, algorithm)}}. See the [migration
> reference|https://github.com/anton-vinogradov/ignite/blob/ignite-29210/docs/_docs/security/ssl-tls.adoc#migrating-an-existing-factory].
> Rename any no-argument {{init()}} method declared by your subclass. Direct
> subclasses of {{AbstractSslContextFactory}} that retain {{checkParameters()}}
> must remove its {{@Override}} and call it from {{createSslBundle()}};
> subclasses of {{SslContextFactory}} can keep that override.
> Plain {{Factory<SSLContext>}} remains supported. Empty stores support clients
> without private keys; loaded stores must remain unchanged while their
> contexts are in use. Unsupported TLS names fail first initialization.
> Certificate-date and empty-chain replacement policies belong to IGNITE-29210.
> h3. Delivery and validation
> [PR #13751|https://github.com/apache/ignite/pull/13751] contains this change.
> At {{c20c22e5}}, all 13 metadata tests, Checkstyle and Javadoc/doclint
> passed. A local TLS handshake check verified that restarting with the same
> factory can reload a new certificate and keep the last working context after
> a failure.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
