question Re: Looking for details for generating client certificate when not using NiFi CA in Archives of Support Questions (Read Only)

Looking for details for generating client certificate when not using NiFi CA

setty_sharath — Tue, 21 Apr 2026 12:26:57 GMT

Hi, we are installing HDF 2 using Ambari and in the step to secure nifi. We have generated certificate and not using NiFi CA.

Trying to follow instructions here:

https://community.hortonworks.com/articles/58009/hdf-20-enable-ssl-for-apache-nifi-from-ambari.html

and here:

http://docs.hortonworks.com/HDPDocuments/HDF2/HDF-2.0.1/bk_ambari-installation/content/generating-client-certificates.html

The instructions are specific to using NiFi CA and am having trouble in understanding what to do if we are not using NiFi CA. We also want to use LDAP authentication which we had done on a standalone nifi instance and are hoping to do the same with this cluster instance. Our installation of nifi through ambari does work in non ssl mode.

Any help/direction is appreciated.

Re: Looking for details for generating client certificate when not using NiFi CA

alopresto — Wed, 16 Nov 2016 09:55:55 GMT

If you are not using the NiFi CA, you can still secure your HDF instances by providing each with resources meeting the following requirements:

Keystore
- The keystore must contain a PrivateKeyEntry containing the private key and public certificate with valid dates and a DN matching the fully-qualified domain name (FQDN) of the host, and if signed by another key, the public certificate of that resource
Truststore
- The truststore must contain a trustedCertEntry containing the public certificate of each authorized user or the CA used to sign the individual certificates.
The nifi.properties file must contain the path to each keystore and truststore and the corresponding password to access each.

To configure LDAP authentication, you follow the same steps as for a standalone instance. The nifi.properties and login-identity-providers.xml files must be synchronized to all nodes in the cluster.

Re: Looking for details for generating client certificate when not using NiFi CA

shariquealam786 — Tue, 17 Sep 2019 09:46:20 GMT

Hi Alo,

We did the SSL on Nifi server with CA signed certificates but not Nifi CA.

I now want to create once client certificate to authenticate to Nifi can you please help me outline the steps.