NettyConnectionClient And NettyClient support SslContext rebuild when reconnect
- Dominant language
- Java
- Stars
- 41.6k
- Forks
- 26.4k
- Avg merge
- 15h 13m
- Merged PRs (30d)
- 4
Description
- [x] I have searched the [issues](https://github.com/apache/dubbo/issues) of this repository and believe that this is not a duplicate.
- [x] I have searched the [release notes](https://github.com/apache/dubbo/releases) of this repository and believe that this is not a duplicate.
## Describe the feature
org.apache.dubbo.remoting.transport.netty4.ExtNettyConnectionClient#initBootstrap
org.apache.dubbo.remoting.transport.netty4.NettyClient#initBootstrap
SslContext均在ChannelInitializer外部构建初始化, 在开启MTls认证时, 客户端证书可能因为轮换或者禁用发生变更, 此时重新建连
是无法使用最新的证书进行认证的.
建议将SslContext sslContext = SslContexts.buildClientSslContext(getUrl()); 迁移到ChannelInitializer内部.
Contributor guide
Research direction
Start with org.apache.dubbo.remoting.transport.netty4.ExtNettyConnectionClient#initBootstrap and NettyClient#initBootstrap, then trace where SslContexts.buildClientSslContext(getUrl()) is called relative to the ChannelInitializer. The change is complete when reconnecting after an mTLS certificate rotation or disablement uses the current client certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100