ssl-cert-nickname declares component-restart but the crypto manager reads it once at startup

[vharseko]

The ssl-cert-nickname property is declared with

<adm:requires-admin-action>
  <adm:component-restart />
</adm:requires-admin-action>

in opendj-maven-plugin/src/main/resources/config/xml/org/forgerock/opendj/server/config/Package.xml:92, and the crypto manager references it (CryptoManagerConfiguration.xml). dsconfig therefore tells the administrator that restarting the component is enough.

For the crypto manager it is not. The value is read once, at startup:

• CryptoManagerImpl.sslCertNicknames is final and assigned only in the constructor, from config.getSSLCertNickname();
• applyConfigurationChange(CryptoManagerCfg) ignores the property entirely, so a live change is accepted and has no effect;
• ReplSessionSecurity then caches the set when it is constructed, at ReplicationServer.java:228 and ReplicationDomain.java:3201, and hands it to getSslContext() on every connection.

An administrator who changes the replication certificate and restarts nothing, or who expects a component restart to suffice, keeps presenting the old certificate with no indication that the new configuration is not in force. The procedure added in #906 works around this by prescribing stop-ds --restart.

Suggestion

Either re-read the property where it is used — applyConfigurationChange() updating the field, and ReplSessionSecurity asking the crypto manager instead of caching — or correct the metadata to <adm:server-restart/> so that dsconfig states what is actually required.

Same question applies to ssl-protocol and ssl-cipher-suite, which ReplSessionSecurity caches the same way.

Raised in the review of #906 by @maximthomas.