question Re: How will I set up Secure NIFI cluster that using my real Cert that I bought instead of self generate. in Archives of Support Questions (Read Only)

How will I set up Secure NIFI cluster that using my real Cert that I bought instead of self generate.

marknguyen — Thu, 27 Oct 2016 06:09:02 GMT

I am following the below procedure but I don't see how I can apply the Cert that I bought.

http://bryanbende.com/development/2016/08/17/apache-nifi-1-0-0-authorization-and-multi-tenancy

Re: How will I set up Secure NIFI cluster that using my real Cert that I bought instead of self generate.

alopresto — Thu, 27 Oct 2016 07:22:06 GMT

Mark,

The certificate you purchased from a certificate authority will identify the NiFi application. Depending on the format it is in (likely a *.key file containing the private key which never left your computer and a *.pem or *.der file containing the corresponding public key, which was then signed via a CSR (Certificate Signing Request) sent to the CA), you will need to build the following files:

Keystore
- This will contain the private key and public key certificate with the issuing CA's public certificate in a chain (as a privateKeyEntry) [see example output below]
Truststore
- This will contain the public key of your client certificate (if using one) in order to authenticate you as a user connecting to the UI/API.

Alternate example using keytool:

You generate a public/private keypair using the Java keytool:
$ keytool -genkey -alias nifi -keyalg RSA -keysize 2048 -keystore keystore.jks
You then export a certificate signing request which you send to the certificate authority:
$ keytool -certreq -alias nifi -keyalg RSA -file nifi.csr -keystore keystore.jks
You will get a CSR file nifi.csr which you send to the CA, and they provide a signed public certificate (and the public certificate of the CA) back cert_from_ca.pem:
$ keytool -import -trustcacerts -alias nifi -file cert_from_ca.pem -keystore keystore.jks

Here is a link to the full steps I ran (I ran my own CA in another terminal to simulate the actions of the external CA) and the resulting output.

Re: How will I set up Secure NIFI cluster that using my real Cert that I bought instead of self generate.

marknguyen — Thu, 27 Oct 2016 22:36:41 GMT

@Andy LoPresto

Hi Andy, Thank you so much for your help. I understanding much better about the Certificates and when you to use TLS Generation Toolkit and what to your for prod environment. I am running into user permission issue. Shall I ask on the same thread or shall I create new question? Thanks for the help Andy!

Re: How will I set up Secure NIFI cluster that using my real Cert that I bought instead of self generate.

alopresto — Fri, 28 Oct 2016 00:12:44 GMT

Mark, I'm glad the answer helped you. You should open a new question for the user permission issue and I will take a look.

Re: How will I set up Secure NIFI cluster that using my real Cert that I bought instead of self generate.

marknguyen — Fri, 28 Oct 2016 04:58:23 GMT

@Andy LoPresto

I have post the new question at the link below.

https://community.hortonworks.com/questions/63901/cant-login-with-the-admin-user-that-configure-in-i.html#answer-63902