From 9ca5f287eb4ad6c136fa49a8f752ff0a535bf088 Mon Sep 17 00:00:00 2001 From: Marcus Sorensen Date: Wed, 22 Mar 2023 14:38:43 -0600 Subject: [PATCH] Support Jetty's live cert reload on HTTPS frontend (#7355) * Support Jetty's live cert reload Signed-off-by: Marcus Sorensen * Update ServerDaemon.java --------- Signed-off-by: Marcus Sorensen Co-authored-by: Marcus Sorensen --- .../main/java/org/apache/cloudstack/ServerDaemon.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/client/src/main/java/org/apache/cloudstack/ServerDaemon.java b/client/src/main/java/org/apache/cloudstack/ServerDaemon.java index 08f856655dc..63cdc45b8dc 100644 --- a/client/src/main/java/org/apache/cloudstack/ServerDaemon.java +++ b/client/src/main/java/org/apache/cloudstack/ServerDaemon.java @@ -45,6 +45,7 @@ import org.eclipse.jetty.server.handler.MovedContextHandler; import org.eclipse.jetty.server.handler.RequestLogHandler; import org.eclipse.jetty.server.handler.gzip.GzipHandler; import org.eclipse.jetty.server.session.SessionHandler; +import org.eclipse.jetty.util.ssl.KeyStoreScanner; import org.eclipse.jetty.util.ssl.SslContextFactory; import org.eclipse.jetty.util.thread.QueuedThreadPool; import org.eclipse.jetty.util.thread.ScheduledExecutorScheduler; @@ -241,6 +242,14 @@ public class ServerDaemon implements Daemon { sslConnector.setPort(httpsPort); sslConnector.setHost(bindInterface); server.addConnector(sslConnector); + + // add scanner to auto-reload certs + try { + KeyStoreScanner scanner = new KeyStoreScanner(sslContextFactory); + server.addBean(scanner); + } catch (Exception ex) { + LOG.error("failed to set up keystore scanner, manual refresh of certificates will be required", ex); + } } }