Silver ⭐️⭐️

Solved

Nifi registry issue with https

11 replies
9735 views
Translate All

I have enabled https on nifi registry properties and generated key store and trust store using tls toolkit and added in the properties file. I am able to start nifi registry on port 18443 and host 0.0.0.0 as it showing in logs that jetty server started on https://0.0.0.0:18443/nifi registry

my nifi registry is hosted as aks pod.
when I enable ingress for it. It’s returning me as 502 bad request.

are there any changes to be done to make my nifi registry run https.

Goal : i want to enable 2 way ssl authentication so that nifi could connect to nifi registry.

MattWhoAnswer

Titanium ⭐️⭐️⭐️

@Knowledgeknow

I am not clear here:
when I enable ingress for it. It’s returning me as 502 bad request

NiFi-Registry is secured once configured with an HTTPS hostname, HTTPS port, keystore, and truststore. For more info: security_configuration

As soon as HTTPS is enabled, TLS/SSL is used. It is either enabled as "REQUIRED" or "WANT", but can not be set to "NONE". This is controlled by
nifi.registry.security.needClientAuth=true (default)
With "true" being "Required" and false being "Want"

In order for NiFi to be able to successfully negotiate a mutual TLS handshake, the NiFi "registry client" must use the HTTPS nifi-registry "https://<nifi-registry hostname>:<port> url and have either the keystore and truststore configured in nifi.properties or a StandardRestrictedSSLContextService configured with valid keystore and truststore.

The NiFi-registry keystore must:
- Contain a single PrivateKeyEntry
- PrivateKey entry has serverAuth EKU
- PrivateKey Entry has SAN entries that include any hostname and IPs that client(s) may use to connect to it. Since you have configured hostname with 0.0.0.0 so that NiFi-Registry binds to all NICs, you'll need to make sure valid network IPs and hostnames are in the SAN.

The NiFi-Regsitry truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi keystore being used by the NiFi Registry Client.

The NiFi keystore must:
- Contain only one PrivateKey Entry.
- PrivateKey DN must not use wildcards
- PrivateKey Entry MUST have both clientAuth and ServerAuth EKU
- PrivateKey Entry must have SAN entries for NiFi hostname, and IPs clients may use to connect to it.

The NiFi truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi-Registry keystore configured in the nifi-registry.properties file.

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

DianaTorres

Community Manager

@Knowledgeknow Welcome to the Cloudera Community!

To help you get the best possible solution, I have tagged our NiFi experts @MattWho @cotopaul who may be able to assist you further.

Please keep us updated on your post, and we hope you find a satisfactory solution to your query.

Translate

Regards, Diana Torres, Senior Community Moderator

MattWhoAnswer

Titanium ⭐️⭐️⭐️

@Knowledgeknow

I am not clear here:
when I enable ingress for it. It’s returning me as 502 bad request

NiFi-Registry is secured once configured with an HTTPS hostname, HTTPS port, keystore, and truststore. For more info: security_configuration

As soon as HTTPS is enabled, TLS/SSL is used. It is either enabled as "REQUIRED" or "WANT", but can not be set to "NONE". This is controlled by
nifi.registry.security.needClientAuth=true (default)
With "true" being "Required" and false being "Want"

In order for NiFi to be able to successfully negotiate a mutual TLS handshake, the NiFi "registry client" must use the HTTPS nifi-registry "https://<nifi-registry hostname>:<port> url and have either the keystore and truststore configured in nifi.properties or a StandardRestrictedSSLContextService configured with valid keystore and truststore.

The NiFi-registry keystore must:
- Contain a single PrivateKeyEntry
- PrivateKey entry has serverAuth EKU
- PrivateKey Entry has SAN entries that include any hostname and IPs that client(s) may use to connect to it. Since you have configured hostname with 0.0.0.0 so that NiFi-Registry binds to all NICs, you'll need to make sure valid network IPs and hostnames are in the SAN.

The NiFi-Regsitry truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi keystore being used by the NiFi Registry Client.

The NiFi keystore must:
- Contain only one PrivateKey Entry.
- PrivateKey DN must not use wildcards
- PrivateKey Entry MUST have both clientAuth and ServerAuth EKU
- PrivateKey Entry must have SAN entries for NiFi hostname, and IPs clients may use to connect to it.

The NiFi truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi-Registry keystore configured in the nifi-registry.properties file.

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

Translate

KnowledgeknowAuthor

Silver ⭐️⭐️

now I have apache secured nifi and secured nifi registry running on local host. When I try to integrate with nifi with nifi registry it’s giving me connection refused. I added the images how I created certificates and the error. I added trust and key store files in nifi registry and nifi properties. I want to make 2 way ssl connection.

Translate

KnowledgeknowAuthor

Silver ⭐️⭐️

I generated those certificates using tiny cert. Do we have any reference script which I could generate self signed certificates for nifi and nifi registry.

Translate

MattWho

Titanium ⭐️⭐️⭐️

@Knowledgeknow
I would think that certs created by tiny cert should be fine.
Troubleshooting mutual TLS handshake this is difficult without the verbose keytool output for the NiFi keystore and truststore and the NiFi-Registry keystore and truststore.

Your first screenshot with connection refused, you'll probably want to look at the nifi-registry-app.log at time you opened that UI to see what may have been logged.

Can the NiFi host resolve and reach the configured Apache NiFi-Registry host? Can this be done via the NiFi service user via command line on the NiFi host?

Once you get past any potential MutualTLS issue, we would need to inspect the configurations you have in place within:
NiFi:

nifi.properties
know what user-identity-string is currently authenticated into you secured NiFi when trying to interact with NiFi-Registry.

NiFi-Registry:

nifi-registry.properties
authorizers.xml
users.xml
authorizations.xml

So there is far too little information to offer up any solution or useful suggestions.
Thank you,
Matt

Translate

KnowledgeknowAuthor

Silver ⭐️⭐️

Certs using tinycert is not acceptable in my organisation. I started creating ca using open ssl and server cert client certs I created a key store and imported ca into true store. When I hit throw browser it’s saying ssl issue.

Translate

DianaTorres

Community Manager

@Knowledgeknow Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. Thanks.

Translate

Regards, Diana Torres, Senior Community Moderator

oneofthemany

Silver ⭐️⭐️

how do use the toolkit to create and IP within the SAN?

I am using the following script:

bash "${NIFI_HOME_DIR}"/nifi/nifi-toolkit-current/bin/tls-toolkit.sh standalone -O -n 'localhost' -C "${cn}" -o "${NIFI_HOME_DIR}"/key_trust --subjectAlternativeNames dns:'localhost',ip:"${NIFI_SAN_IP}"

but only the DNS:localhost gets created

Translate

MattWho

Titanium ⭐️⭐️⭐️

@oneofthemany
You would get better traction form the community by starting a new question since this question already has an accepted solution and has nothing to do with NiFi TLS-toolkit usage.

Thank you,
Matt

Translate

oneofthemany

Silver ⭐️⭐️

thanks, I have created a new post:

https://community.cloudera.com/t5/Support-Questions/NiFi-SAN-IP-using-toolkit-NiFI-Registry/td-p/383130

Translate

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.