Support for dynamically reload SSL certificate and key?

[ExploreNcrack]

Is it possible to dynamically reload the SSL certificate and key for the existing connection so that we can avoid making new connection when certificate and key files have changed?

[sazzad16]

@ExploreNcrack No.

[ExploreNcrack]

@ExploreNcrack No.

@sazzad16 So when certificate and key files have changed, all I can do is just to replace the reference of the existing connection with a new connection?

[sazzad16]

@ExploreNcrack Yes.

[ExploreNcrack]

Alright thank you!

[Hakky54]

I think it might be possible. I just analysed the client and it looks like the JedisPooled has an option to set the SSLSocketFactory. So no need to create a new client or replace the reference of the existing connection. See here for the code snippet:

SSLFactory baseSslFactory = SSLFactory.builder()
    .withIdentityMaterial(Paths.get("/path/to/your/identity.jks"), "password".toCharArray())
    .withTrustMaterial(Paths.get("/path/to/your/truststore.jks"), "password".toCharArray())
    .withSwappableIdentityMaterial()
    .withSwappableTrustMaterial()
    .build();

JedisPooled jedisPooled = new JedisPooled(url, baseSslFactory.getSslSocketFactory(), baseSslFactory.getSslParameters(), sslfactory.getHostnameVerifier());

After some time when you have the new keystore/truststore either from an endpoint, or changes on the file system or from somewhere else, you can execute the following snippet to update the server ssl without the need of restarting it:

// create a new sslFactory with the updated keystore/truststore
SSLFactory updatedSslFactory = SSLFactory.builder()
    .withIdentityMaterial(Paths.get("/path/to/your/identity.jks"), "password".toCharArray())
    .withTrustMaterial(Paths.get("/path/to/your/truststore.jks"), "password".toCharArray())
    .build();

SSLFactoryUtils.reload(baseSslFactory, updatedSslFactory);

See here for the documentation of this option: Swapping KeyManager and TrustManager at runtime

This option is available within the following library here: GitHub - SSLContext Kickstart which I made, hopefully you guys will like it and hopefully it will make it easier for you all to set it up.

[github-actions[bot]]

This issue is marked stale. It will be closed in 30 days if it is not updated.