Implement SSL bundle reload #37808
Closed
Implement SSL bundle reload #37808
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mhalbritter
added
type: enhancement
mhalbritter
commented
Oct 10, 2023
| @@ -7,6 +7,6 @@ org.gradle.jvmargs=-Xmx2g -Dfile.encoding=UTF-8 | |||
| kotlinVersion=1.9.10 | |||
| nativeBuildToolsVersion=0.9.27 | |||
| springFrameworkVersion=6.1.0-SNAPSHOT | |||
| tomcatVersion=10.1.13 | |||
| tomcatVersion=10.1.14 | |||
There was a problem hiding this comment.
This breaks some tests, which I haven't fixed in this PR. I had to upgrade the Tomcat version to be able to call protocol.addSslHostConfig(sslHostConfig, true);
mhalbritter
commented
Oct 10, 2023
...boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/ssl/FileWatcher.java
Outdated
Show resolved
Hide resolved
mhalbritter
commented
Oct 10, 2023
...configure/src/main/java/org/springframework/boot/autoconfigure/ssl/SslAutoConfiguration.java
Show resolved
Hide resolved
mhalbritter
force-pushed
the
mh/37131-investigate-hot-reloading-of-tls-certificates-for-embedded-web-servers
branch
from
c9e4595 to
438781e
Compare
|
@philwebb did a pass over the code, I force pushed this PR with his changes. Besides the Tomcat upgrade which breaks some tests this is ready to merge. |
mhalbritter
added
status: blocked
wilkinsona
removed
the
status: blocked
wilkinsona
added a commit
that referenced
this pull request
Oct 18, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Implements reloading of SSL bundles. Netty and Tomcat react to SSL bundle reload and hot-reload their SSL certificates (existing connections use the old key material, new connections use the new material).
Implemented a FileWatcher based on
java.nioto watch for file changes.Adds new properties to JKS and PEM bundles to control reload. If reload is enabled, the keystore / key files / certificate files are automatically watched and reload the SSL bundle if they change (which in turn will trigger reload of SSL in tomcat / netty).
I had to refactor the
PemContentclass a bit, because we now need to know at 2 places if the PEM SSL bundle configuration points is a URL or PEM content.