hiero-ledger / hiero-ledger/hiero-consensus-node

Migrate Cryptography From PFX Files To PEM Files

Open
#16,146 3 comments 0 reactions 0 assignees View on GitHub
Epic Platform
Dominant language
Java
Stars
406
Forks
226
Avg merge
3d 4h
Merged PRs (30d)
210

Description

PR https://github.com/hashgraph/hedera-services/pull/16025 has merged into release 0.56 which automatically extracts the cryptography from PFX files and creates PEM files. This is the first step. Next we need to manually migrate the use of PFX files to PEM files in all of our processes, backups, and disaster recovery.

After 0.56 the following should be true about the cryptography on disk post migration code execution
1. There are no more PFX files in the cryptography directory.
* If they existed, they were moved to a subdirectory `.archive/yyyy-MM-dd_HH-mm-ss`
2. There are no PEM files related to agreement keys
* agreement keys are being generated every time the node restarts.
3. There is a single `s-private-node#.pem` key that is the private gossip signing key.
4. There is a `s-public-node#.pem` file for every node in the address book.
* The # portion is 1+ the node's id. Node with id 6 will have `s-public-node7.pem` as the name of the file containing its public gossip signing key.
5. There may be a `.archive` subdirectory containing the old PFX files in a directory named by the date the migration took place.
* This directory is not backed up. If the directory is deleted, the PFX files will be lost unless the node operator has a copy stored somewhere else.

### Mainnet
- [ ] Document for Node Operators about What, When, Why, How on managing the PEM file.
- [ ] Verify that every node operator has stored their private signing key PEM file in backup and disaster recovery processes.

### DevOps
- [ ] Update tools to generate PEM files instead of PFX files.
- [ ] Store/Use PEM files instead of PFX files in backup/restore process of test networks.

### SOLO
- [x] Generate PEM files instead of PFX files.

### JRS
- https://github.com/hiero-ledger/hiero-consensus-node/issues/18196
- https://github.com/hiero-ledger/hiero-consensus-node/issues/18329

### HAPI
- [ ] Replace PFX files in HAPI tests with the appropriate PEM files.

### Unit Tests
- [ ] Replace PFX files in unit tests with the appropriate PEM files.

### Source Code Maintenance
- [ ] Delete the cryptography migration code when all the other tasks lists are complete.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the release 0.56 migration and the linked JRS issues, then inventory PFX usage across node processes, backups, disaster recovery, HAPI tests, and unit tests. Done means those workflows use the specified PEM files, operators have documented backup guidance, and the migration checklist is complete before its migration code is removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
devops, security, testing
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.