question Re: Securing NiFi - Cannot see UI in Support Questions

Securing NiFi - Cannot see UI

frassis — Fri, 15 Nov 2019 23:09:05 GMT

Hi folks,

We have been struggling for the past 3 weeks trying to secure a cluster.

We have 3 nodes. They were working ok in a cluster (but not secured).

When trying to secure those (and following the guide suggested here), we came across the following message when trying to access the UI:

javax.net.ssl.SSLPeerUnverifiedException: Hostname <my_fqdn_is_here> not verified: certificate: sha256/716mOuXyoAKqzNrXrNnG2ozHXwN8WWJsVxzWzfQzpNV= DN: CN=xxx-xxxx-xxxx.xxx.xxx.net, OU=XXXXXXXXX XXXXXX, O=XXXXX, L=XXXXXX, ST=XXXXXX XXXXX, C=CA subjectAltNames: []

We've been going over and over the configs and nothing seems to point to the right direction.

Would anyone point us to at least the right direction?

Re: Securing NiFi - Cannot see UI

ask_bill_brooks — Fri, 15 Nov 2019 23:12:31 GMT

@frassis You wrote that you were " following the guide suggested here", but there was no indication as to what guide you were actually following. Did you perhaps forget the hyperlink?

Re: Securing NiFi - Cannot see UI

MattWho — Mon, 18 Nov 2019 13:49:19 GMT

@frassis

The error message you have encountered indicates and issue with the certificates you are using to secure your NiFi nodes.

Jetty no longer uses the DN to verify hostnames and now requires that the certificates include at least 1 Subject Alternative Name (SAN) entry that matches the hostname of the server on which it is being used.

As you can see from the ERROR output, it indicates you have no SAN entries in your cert.

subjectAltNames: []

You will need to generate new certificates and keystores for your NiFi nodes.
When doing so keep in mind the following:
1. Keystore may contain ONLY 1 PrivateKeyEntry
2. The PrivateKeyEntry MUST support both "clientAuth" and "serverAuth"
3. The PrivateKeyEntry MUST contain at least 1 SAN entry matching the hostname of the server where keystore will be used.
4. The Keystore and Key passwords must be the same. Or no key password set.

Thank you,

Matt

Re: Securing NiFi - Cannot see UI

gdizzz — Tue, 19 Nov 2019 19:34:04 GMT

Hey @MattWho, thank you very much for this.

Quick question, how do you determine if the PrivateKeyEntry supports both?

"The PrivateKeyEntry MUST support both "clientAuth" and "serverAuth""?

I don't see this when i use keytool -v

Re: Securing NiFi - Cannot see UI

frassis — Mon, 02 Dec 2019 19:19:40 GMT

Thanks Matt,

With new certs, like you mentioned, we were able to make it work.