[jira] [Created] (CASSANDRA-19690) Reload new keystores/truststores in ReloadSSL

["FAUSTO FIORESE BRANCO (Jira)" <ji...@apache.org>]

FAUSTO FIORESE BRANCO created CASSANDRA-19690:
-------------------------------------------------

             Summary: Reload new keystores/truststores in ReloadSSL
                 Key: CASSANDRA-19690
                 URL: https://issues.apache.org/jira/browse/CASSANDRA-19690
             Project: Cassandra
          Issue Type: Improvement
            Reporter: FAUSTO FIORESE BRANCO


During the last month, we rotated our *client_encryption_options* and *server_encryption_options* certificates. Everything seemed fine, until the certificate expired and we {*}started having serious issues in several of our clusters{*}.

We need to restart all nodes, if there is unavailability, because when restarting the nodes, of course, the encryption was different.

When analysing the cause, I realised that from the *ReloadSslCertificates* method in *NoteTool.java* until the end of the process in {*}SSLFactory.java{*}, the cassandra.yaml configurations *are never reloaded* to the new *Keystore* and *Truststore* files.

In our scenario, exchanging the certificate generates new keystores and truststores and as there is no documentation indicating that it needs to be the same name/file as the KS/TS, the expected behavior was for the certificate to be exchanged according to what is in the yaml.

My suggestion would be to reload the cassandra.yaml settings and load the new KS/TS before rotating the certificate and improving the documentation.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org