Effect to a SSLEngine when calling init() of a shared SSLContext object again

Question

I have an implementation of reactor pattern in which I load the SSLContext when a TransportListener (Basically a listener listening on a given port for HTTPS connections.) is starting.

Then I call the same init() method again (through a JMX call to a listener's method)

sslContext.init(keyManagers, trustManagers, null);

once I add or remove a certificate to/from the trust store. I have to reload the SSLContext in order to avoid any down time in the listener.

So this is the problem I'm currently facing.

Suppose a request come to the listener and an connection is established. If I reload the SSLContext object before the response is returned to the client, will that affect the connection's SSLEngine object's wrap process which encrypts the payload before sending?

Note : I have validated that the same SSLContext object is being passed to all the SSLEngines.The SSLContext object is passed to several other objects when the Listener is starting. For example, I have a connection pool to which I have to pass this SSLContext object. Therefore creating a new SSLContext object will completely break the existing connections is the connection pool. That is why i'm trying to use the same SSLContext object.

Answer 1

You need to think this through. If you have an established connection, it has already had a certificate exchange, successfully, so it has no need of new certificates, so no need of a new or reinitialized SSLContext, up to and including partial handshakes, e.g. to rekey the current session, or request a client certificate. It shouldn't use the SSLContext at all for anything short of a full handshake.

What you need to do is starting using a new SSLContext for all the new connections that are going to need the new certificate. You don't need to do anything to existing connections, by definition.