Does grpc-java supports cert reload without restarting server?

[Daisy Zhu]

Does grpc-java supports cert refresh without restarting server?

[Danesh Kuruppu]

Hi Daisy,

Does grpc-java supports cert refresh without restarting server?

AFAIK, this is not supported yet. We need to restart the server.

Please correct me if I am wrong.

Thanks

Danesh

[Daisy Zhu]

Hi Danesh,

Thanks for your reply.

How do you restart your server? And seems hot rotating cert is a general requirement. Do you aware any concern that grpc hasn't supported this?

Best,

Daisy

[Carl Mastrangelo]

You are correct, Java doesn't support this.   However, if you are using the round robin load balancer in your client, you should be able to gracefully restart your servers with the new certificate without dropping any requests.

On Thursday, February 7, 2019 at 6:52:46 AM UTC-8, Danesh Kuruppu wrote:

[Daisy Zhu]

Thanks for the reply.

Is this the document  https://grpc.io/blog/loadbalancing on round robin load balancer you mentioned? For cert hot rotation which way is recommended?

1. round robin load balancer in client side 

2. implement hot cert reloading in sever side

If using method 2 are there any potential issues needed to be paid attention to?

Best,

Daisy

[sanjay...@google.com]

Hi Daisy

There is an issue on github  https://github.com/grpc/grpc-java/issues/5335 that talks about the same thing and possibly created by you.

There is a comment https://github.com/grpc/grpc-java/issues/5335#issuecomment-462531217 that describes an approach to achieve this. Can you verify if it works for you?

[sanjay...@google.com]

A gentle reminder for Daisy - were you able to verify?

[Daisy Zhu]

Hi,

I haven't verified. For me I think creating a new SslContextBuilder object is simpler and straightforward.

-Daisy

[Sanjay Pujare]

No problem. Will you be contributing your code via a PR? 

Sanjay

--
You received this message because you are subscribed to a topic in the Google Groups "grpc.io" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/grpc-io/Yh11G6wrNtA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to grpc-io+u...@googlegroups.com.
To post to this group, send email to grp...@googlegroups.com.
Visit this group at https://groups.google.com/group/grpc-io.
To view this discussion on the web visit https://groups.google.com/d/msgid/grpc-io/c7f2c95d-0a59-4ec7-8e33-d12d1bddc481%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Daisy Zhu]

I commented on the issue. 

Thanks,

Daisy