hiero-ledger / hiero-ledger/hiero-consensus-node
Migrate Cryptography From PFX Files To PEM Files
- Dominant language
- Java
- Stars
- 406
- Forks
- 226
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 210
Description
PR https://github.com/hashgraph/hedera-services/pull/16025 has merged into release 0.56 which automatically extracts the cryptography from PFX files and creates PEM files. This is the first step. Next we need to manually migrate the use of PFX files to PEM files in all of our processes, backups, and disaster recovery.
After 0.56 the following should be true about the cryptography on disk post migration code execution
1. There are no more PFX files in the cryptography directory.
* If they existed, they were moved to a subdirectory `.archive/yyyy-MM-dd_HH-mm-ss`
2. There are no PEM files related to agreement keys
* agreement keys are being generated every time the node restarts.
3. There is a single `s-private-node#.pem` key that is the private gossip signing key.
4. There is a `s-public-node#.pem` file for every node in the address book.
* The # portion is 1+ the node's id. Node with id 6 will have `s-public-node7.pem` as the name of the file containing its public gossip signing key.
5. There may be a `.archive` subdirectory containing the old PFX files in a directory named by the date the migration took place.
* This directory is not backed up. If the directory is deleted, the PFX files will be lost unless the node operator has a copy stored somewhere else.
### Mainnet
- [ ] Document for Node Operators about What, When, Why, How on managing the PEM file.
- [ ] Verify that every node operator has stored their private signing key PEM file in backup and disaster recovery processes.
### DevOps
- [ ] Update tools to generate PEM files instead of PFX files.
- [ ] Store/Use PEM files instead of PFX files in backup/restore process of test networks.
### SOLO
- [x] Generate PEM files instead of PFX files.
### JRS
- https://github.com/hiero-ledger/hiero-consensus-node/issues/18196
- https://github.com/hiero-ledger/hiero-consensus-node/issues/18329
### HAPI
- [ ] Replace PFX files in HAPI tests with the appropriate PEM files.
### Unit Tests
- [ ] Replace PFX files in unit tests with the appropriate PEM files.
### Source Code Maintenance
- [ ] Delete the cryptography migration code when all the other tasks lists are complete.
Contributor guide
Research direction
Start by reviewing the release 0.56 migration and the linked JRS issues, then inventory PFX usage across node processes, backups, disaster recovery, HAPI tests, and unit tests. Done means those workflows use the specified PEM files, operators have documented backup guidance, and the migration checklist is complete before its migration code is removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- devops, security, testing
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100