Interface HttpCertificateProvider

All Known Implementing Classes:
HttpPlugin, HttpPlugin, MqttPlugin
public interface HttpCertificateProvider
ECMWF Product Data Store (OpenECPDS) Project Implemented by plugins (and remote-interface bridge objects) that expose an HTTPS server and can report on or replace the active TLS certificate.

Placing this interface in the ecmwf.common.security package (rather than in a plugin sub-package) ensures it is loaded by the application class loader and is therefore visible to RMI server threads and other components that cannot reach classes loaded by an isolated plugin class loader.

Since:
2024-07-01
Version:
6.7.7
Author:
Laurent Gougeon - syi@ecmwf.int, ECMWF.

  • Method Summary

    Modifier and Type
    Method
    Description
    String
    buildCertificateJson()
    Returns a JSON-encoded snapshot of the TLS certificate currently loaded by this plugin's HTTPS server, or "{}" if no certificate is available.
    void
    deployCertificate(byte[] pkcs12Bytes, String keystorePassword)
    Deploys a new PKCS#12 keystore to this plugin's HTTPS server and hot-reloads the certificate without restarting the server (where supported).
    void
    reloadCertificate()
    Hot-reloads the TLS certificate from the keystore file currently on disk, without requiring a new keystore to be uploaded.

  • Method Details

    • buildCertificateJson

      String buildCertificateJson()
      Returns a JSON-encoded snapshot of the TLS certificate currently loaded by this plugin's HTTPS server, or "{}" if no certificate is available.
      Returns:
      JSON string; never null

    • deployCertificate

      void deployCertificate(byte[] pkcs12Bytes, String keystorePassword) throws Exception
      Deploys a new PKCS#12 keystore to this plugin's HTTPS server and hot-reloads the certificate without restarting the server (where supported).
      Parameters:
      pkcs12Bytes - the PKCS#12 keystore bytes
      keystorePassword - password for the keystore and private key
      Throws:
      Exception - if the deployment or reload fails

    • reloadCertificate

      void reloadCertificate() throws Exception
      Hot-reloads the TLS certificate from the keystore file currently on disk, without requiring a new keystore to be uploaded. Use this after replacing the keystore file via automation or a secrets manager.
      Throws:
      Exception - if the reload fails