WFCORE-5744 - improve keystore certificate health check #6420
Conversation
baranowb
added
Feature
baranowb
changed the title
| --> | ||
|
|
||
| <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" | ||
| targetNamespace="urn:wildfly:elytron:community:18.1" |
There was a problem hiding this comment.
Need to think about what is the correct updates needed here but we avoid minor bumps.
elytron/src/main/java/org/wildfly/extension/elytron/CertificateChainAttributeDefinitions.java
Show resolved
Hide resolved
elytron/src/main/java/org/wildfly/extension/elytron/ElytronExtension.java
Outdated
Show resolved
Hide resolved
| //delay in ms between service start and periodical check of certificate health | ||
| //if set to '0', this will mean one-time off warning, as prior to RFE | ||
| private long expirationCheckDelay = DEFAULT_DELAY; | ||
| private ScheduledExecutorService scheduledExecutorService; |
There was a problem hiding this comment.
FYI as part of the CVE I am working on I am adding the scheduled executor service to the root of the Elytron subsystem so all Elytron services can share the same executor.
| pathResolver = null; | ||
| } | ||
| } finally { | ||
| this.scheduledExecutorService.shutdownNow(); |
There was a problem hiding this comment.
Looking at how this is handled for the executors elsewhere a more complete shutdown solution is needed but the shared executor I am adding will have that,
| final CertificateValidity certificateValidity = CertificateValidity.getValidity(xCertificate.getNotBefore(), xCertificate.getNotAfter()); | ||
| switch(certificateValidity) { | ||
| case ABOUT_TO_EXPIRE: | ||
| ROOT_LOGGER.certificateAboutToExpire(keyStoreName, alias); |
There was a problem hiding this comment.
We probably need a mechanism to avoid spamming the logs for the same certificate, especially if they want a frequent check.
There was a problem hiding this comment.
hmm, whats the point of check than ?
elytron/src/main/java/org/wildfly/extension/elytron/CertificateValidity.java
Outdated
Show resolved
Hide resolved
elytron/src/main/java/org/wildfly/extension/elytron/KeyStoreDefinition.java
Show resolved
Hide resolved
baranowb
force-pushed
the
WFCORE-5744_29.x
branch
from
f90129f to
8a54d77
Compare
baranowb
force-pushed
the
WFCORE-5744_29.x
branch
from
8a54d77 to
7445a58
Compare
|
Core -> Full Integration Build 14455 outcome was FAILURE using a merge of 7445a58 |
|
Core -> Full Integration Build 14461 outcome was UNKNOWN using a merge of 7445a58 |
Issue: https://issues.redhat.com/browse/WFCORE-5744
Proposal: https://issues.redhat.com/browse/EAP7-1863