question Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ? in Archives of Support Questions (Read Only)

How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

marsip — Wed, 11 Oct 2017 21:50:12 GMT

Hello everyone,

I'm using NiFi 1.4 and I'm trying to accept Protocol TLS1.1 for the HandleHTTPRequest processor (thanks to StandardSSLContextService) but only TLS 1.2 is accepted.

How to force the protocol TLS 1.1 ? I already try something like "java.arg.16=-Ddeployment.security.TLSv1.1=true" in the bootstrap.conf but nothing changed.

Have you an idea ?!

Thanks for your help.

Laurent

Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

alopresto — Wed, 11 Oct 2017 23:57:42 GMT

Hi Laurent,

Apache NiFi 1.4.0 uses Jetty 9.4.2 to provide the underlying web server, and Jetty after versions 9.4.0 only supports TLS v1.2 for incoming connections. I would recommend using a proxy with TLS termination which accepts incoming TLS v1.1 connections and re-establishing a connection to your NiFi service which uses TLS v1.2.

* Ticket - NIFI-3361 Upgrade Jetty https://issues.apache.org/jira/browse/NIFI-3361

* Ticket - NIFI-3720 Update documentation for TLS protocol version changes https://issues.apache.org/jira/browse/NIFI-3720

* Jetty Documentation TLS and SSL Versions https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#tls-and-ssl-versions

* Apache NiFi Release Notes for 1.2.0 noting TLS protocol version changes https://cwiki.apache.org/confluence/display/NIFI/Release+Notes#ReleaseNotes-Version1.2.0

* Apache NiFi Migration Guidance for 1.1.0 -> 1.2.0 noting the change https://cwiki.apache.org/confluence/display/NIFI/Migration+Guidance

The actual announcement that Jetty changed the protocol versions supported is buried in their release notes somewhere.

Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

marsip — Thu, 12 Oct 2017 02:50:36 GMT

Thanks Andy for your very complete answer !

I read that Jetty improved recently the security with TLS 1.2 only (very good !) but I hoped it was possible to force a weak protocol (bad but sometime, it's necessary...).

As you told me, my only choice is the installation of a proxy like HAProxy or Squid !

Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

alopresto — Thu, 12 Oct 2017 04:54:10 GMT

Laurent, feel free to contact me directly at alopresto@apache.org for further discussion.