Restart the instance when new subsystems are deployed

[fmarco76]

If a new subsystem is deployed in a existing instance this not restarted during the installation but the new web-app is just enabled.

When the subsystem are configured to work with an HSM this could generate problems because certificates added during the installation with external tools are recognised. The instance restart will clean the internal cache and reference to the HSM and all certificates are identified.

Fix the issue #4335

[edewata]

So the original code works like this:

if this is the first subsystem
    enable subsystem (which might be redundant)
    if using legacy ID generator:
        create temp SSL server cert
        start the server

if this is the first subsystem:
    if using legacy ID generator:
        stop the server
        remove temp SSL server cert
    use permanent SSL server cert
else:
    enable subsystem (without restarting the server)

if this is the first subsystem:
    start the server

IIUC the proposed code works like this:

if this is the first subsystem:
    enable subsystem (which might be redundant)
    if using legacy ID generator:
        create temp SSL server cert
        start the server

if this is not the first subsystem or using legacy ID generator:
    stop the server

if this is the first subsystem:
    if using legacy ID generator
        remove temp SSL server cert
    use permanent SSL server cert

start the server

I think the above code works, but I'm wondering if we can avoid restarting the server if it doesn't use HSM (because that would be faster), so something like this:

if this is the first subsystem:
    enable subsystem (which might be redundant)
    if using legacy ID generator:
        create temp SSL server cert
        start the server

if this is the first subsystem:
    if using legacy ID generator:
        stop the server
        remove temp SSL server cert
    use permanent SSL server cert
else:
    if using HSM:
        restart the server (which will automatically enable the subsystem)
    else:
        enable subsystem (without restarting the server)

if this is the first subsystem:
    start the server

It doesn't have to be exactly like this, but that's the idea. What do you think?

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

0.0% Coverage
0.0% Duplication

[fmarco76]

So the original code works like this:

if this is the first subsystem
    enable subsystem (which might be redundant)
    if using legacy ID generator:
        create temp SSL server cert
        start the server

if this is the first subsystem:
    if using legacy ID generator:
        stop the server
        remove temp SSL server cert
    use permanent SSL server cert
else:
    enable subsystem (without restarting the server)

if this is the first subsystem:
    start the server

IIUC the proposed code works like this:

if this is the first subsystem:
    enable subsystem (which might be redundant)
    if using legacy ID generator:
        create temp SSL server cert
        start the server

if this is not the first subsystem or using legacy ID generator:
    stop the server

if this is the first subsystem:
    if using legacy ID generator
        remove temp SSL server cert
    use permanent SSL server cert

start the server

I think the above code works, but I'm wondering if we can avoid restarting the server if it doesn't use HSM (because that would be faster), so something like this:

if this is the first subsystem:
    enable subsystem (which might be redundant)
    if using legacy ID generator:
        create temp SSL server cert
        start the server

if this is the first subsystem:
    if using legacy ID generator:
        stop the server
        remove temp SSL server cert
    use permanent SSL server cert
else:
    if using HSM:
        restart the server (which will automatically enable the subsystem)
    else:
        enable subsystem (without restarting the server)

if this is the first subsystem:
    start the server

It doesn't have to be exactly like this, but that's the idea. What do you think?

I have updated the code to be in line with this idea.

[edewata]

Thanks for the update! LGTM.

[fmarco76]

@edewata Thanks!