apache / apache/dubbo

NettyConnectionClient And NettyClient support SslContext rebuild when reconnect

Open
#13,225 0 comments 0 reactions 0 assignees View on GitHub
component/sdk help wanted type/proposal
Dominant language
Java
Stars
41.6k
Forks
26.4k
Avg merge
15h 13m
Merged PRs (30d)
4

Description

- [x] I have searched the [issues](https://github.com/apache/dubbo/issues) of this repository and believe that this is not a duplicate.
- [x] I have searched the [release notes](https://github.com/apache/dubbo/releases) of this repository and believe that this is not a duplicate.

## Describe the feature

org.apache.dubbo.remoting.transport.netty4.ExtNettyConnectionClient#initBootstrap
org.apache.dubbo.remoting.transport.netty4.NettyClient#initBootstrap
SslContext均在ChannelInitializer外部构建初始化, 在开启MTls认证时, 客户端证书可能因为轮换或者禁用发生变更, 此时重新建连
是无法使用最新的证书进行认证的.
建议将SslContext sslContext = SslContexts.buildClientSslContext(getUrl()); 迁移到ChannelInitializer内部.

Contributor guide

Open the contributing guide

Research direction

Start with org.apache.dubbo.remoting.transport.netty4.ExtNettyConnectionClient#initBootstrap and NettyClient#initBootstrap, then trace where SslContexts.buildClientSslContext(getUrl()) is called relative to the ChannelInitializer. The change is complete when reconnecting after an mTLS certificate rotation or disablement uses the current client certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
networking, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.