question Re: Setting StandardSSLContext service for listenTCP in Archives of Support Questions (Read Only)

Setting StandardSSLContext service for listenTCP

dhieru — Sun, 18 Aug 2019 07:28:39 GMT

Hi All,

Thanks a lot to this aweosme community.

I am trying to set server.key and server.pem store in some directory on my nifi node using StandardSSLcontext service, the type is pkcs12.

Which property will be set here

Keystore properties or

the Truststore ones

I am confused between terminalogies any help

I do not have much idea about keys and certs

Thanks Dheeru

Re: Setting StandardSSLContext service for listenTCP

dhieru — Wed, 08 Nov 2017 06:45:47 GMT

I read this blog (https://bryanbende.com/development/2017/10/13/apache-nifi-tls-with-apache-solr) by @Bryan Bende and looks

like I need download the

nifi-toolkit-1.4.0-bin.tar.gz ( asc, md5, sha1, sha256 ) from

https://nifi.apache.org/download.html and make a keystore or truststore or both?

Am I going in the right direction?

Thanks

Dheeru

Re: Setting StandardSSLContext service for listenTCP

alopresto — Wed, 08 Nov 2017 08:50:53 GMT

You need the private key and public key to be stored in a Java Keystore (*.jks) file. You can import the PEM-encoded certificate and key into this form by using the following commands:

openssl pkcs12 -export -in server.pem -inkey server.key -out server.p12 -name [some-alias] -chain

keytool -importkeystore -deststorepass [yourpassword] -destkeypass [yourpassword] -destkeystore server.jks -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass [passwordfromabove] -alias [some-alias]

When creating the temporary PKCS12 keystore, make sure to provide a password at the prompt, or the Java keytool utility will not accept it. Once you have the server.jks file, populate the properties as follows:

Keystore file: path/to/server.jks
Keystore password: [yourpassword]
Key password: [yourpassword]
Keystore type: JKS

This will allow your NiFi instance/component to present a server certificate identifying itself and encrypt the channel. However, to connect to external HTTPS services, you will also need to provide a truststore. A truststore is a keystore file that contains only public certificates of other services to allow your system (in this case, NiFi) to trust them. If you have custom organizational certificates, you'll need to build your own truststore here. If you are just connecting to generic internet services, the JRE default should be fine:

Truststore file: /Library/Java/JavaVirtualMachines/jdk1.8.0_101.jdk/Contents/Home/jre/lib/security/cacerts (your JRE path may be different)
Truststore password: changeit
Truststore type: JKS

Re: Setting StandardSSLContext service for listenTCP

dhieru — Wed, 08 Nov 2017 21:31:18 GMT

@Andy LoPresto

Thanks a lot, appreciate it