NiFi InvokeHttp processor with self-signed endpoint

[#1]

I'm trying to use InvokeHTTP to write to webhdfs via Knox (into a kerberos secured cluster). Knox is using a self-signed certificate and that is not likely to change. If I use curl with the -k param to allow self-signed certs I can successfully write to HDFS. When using InvokeHTTP though, it barfs on the self-signed cert ("unable to find valid certification path to requested target"). I'm using Apachie NiFi 1.0 (though same problem with 0.7) with HDP 2.2 cluster. Any ideas?

[#2 · Accepted solution]

Hi Oliver. One would need to configure SSL context and add the self-signed certificate to the keystore used by it. Take a look at https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi.ssl.StandardSSLContextService/inde...

The components which support SSL will have a controller service property to reference. You would configure all SSL details and keystores in there, to be used by other processors.

[#3]

Thanks Andrew - didn't read deep enough into the docs.