[anton-vinogradov]

Fixes IGNITE-29209.

Add AbstractSslContextFactory.createNew() to build a fresh SSL context without replacing the context cached by create(). The new createKeyMaterial() hook supplies key managers and certificate metadata together. SslContextFactory obtains both from one store load, so the reported chain describes the keys used by that context.

Existing subclasses can continue overriding the deprecated createKeyManagers() hook; its adapter leaves the chain unknown. New subclasses can implement createKeyMaterial() alone. Subclasses that build contexts in an overridden create() must also implement createNew() to use the fresh-context API. The existing SslContextFactory manager adapter and public wrapper constructor remain supported. The wrapper copies certificate arrays defensively and preserves peer addresses and delegate TLS settings when no overrides are supplied.

If a node keystore is accidentally replaced with a trust-only store, fresh context creation can still succeed. The prepared manual reload implementation uses privateKeyMissing to reject that replacement and keep the working context. An unknown chain, including a store with multiple private keys, is a different case. Clients that do not need a private key remain valid.

This is the API prerequisite for the TLS hot reload work. Following changes use the chain for reload validation, status and expiry scheduling; node reload, automatic renewal and HTTP REST integration are separate changes. Merge the included peer-address fix #13750 first: metadata wrapping must retain the address of client engines that previously used an unwrapped context.

Tests build the stores they need, including two private keys, trusted certificates only, and secret-key entries. Validity dates, aliases and TLS settings are explicit where they affect the assertion; ordinary valid certificates use shared fixture defaults. Bouncy Castle is a test-only dependency for certificate generation.

Validation: all 12 metadata tests pass on cbef7aa5, with zero Checkstyle violations. Source and binary compatibility checks for legacy subclasses and targeted API Javadoc/doclint checks cover the unchanged production API.

[anton-vinogradov]

/runall

[ignite-pr-checker]

@anton-vinogradov Ignite PR Checker verdict · RunAll build 9444364 · tested ae42041 · 149 suites ran, 0 reused

⚠️ This run doesn't cover the PR fully:

• mixed run — Queries 5 re-ran on bda9a61, the rest of the RunAll ran on ae42041; only a RunAll of the PR's head can prove it clean

Everything below is what it did manage to say.

🔎 No blockers found — but the run above can't prove the PR is clean. 19 failing tests are not blamed on this PR. Re-run after you handle what is listed above.

_{What each label means and what to do: verdict glossary.}

The PR is now at bda9a61.

♻️ Settled after 1 auto re-run wave: #1 — 1 broken suite.

🔁 Superseded by the newer RunAll 9444873 — its verdict is on the checker's page.

[anton-vinogradov]

/runall

[ignite-pr-checker]

@anton-vinogradov Ignite PR Checker verdict · RunAll build 9444873 · tested 65c8098 · 149 suites ran, 0 reused

⚠️ This run doesn't cover the PR fully:

• mixed run — Cache (Failover) 5 re-ran on fbf5c51, the rest of the RunAll ran on 65c8098; only a RunAll of the PR's head can prove it clean

Everything below is what it did manage to say.

🔎 No blockers found — but the run above can't prove the PR is clean. 19 failing tests are not blamed on this PR. Re-run after you handle what is listed above.

_{What each label means and what to do: verdict glossary.}

The PR is now at cbef7aa.

♻️ Settled after 1 auto re-run wave: #1 — 2 suites that failed mid-run.

🔁 Superseded by the newer RunAll 9445513 — its verdict is on the checker's page.

[anton-vinogradov]

/runall

[ignite-pr-checker]

@anton-vinogradov Ignite PR Checker verdict · RunAll build 9445513 · tested cbef7aa · 149 suites ran, 0 reused

✅ No blockers — nothing in this run looks caused by this PR. 21 failing tests are not blamed on this PR.

_{What each label means and what to do: verdict glossary.}

♻️ Settled after 1 auto re-run wave: #1 — 3 suites that failed mid-run.