Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

Solved Go to solution
Highlighted

How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

New Contributor

Hello everyone,

I'm using NiFi 1.4 and I'm trying to accept Protocol TLS1.1 for the HandleHTTPRequest processor (thanks to StandardSSLContextService) but only TLS 1.2 is accepted.

How to force the protocol TLS 1.1 ? I already try something like "java.arg.16=-Ddeployment.security.TLSv1.1=true" in the bootstrap.conf but nothing changed.

Have you an idea ?!

Thanks for your help.

Laurent
:)

1 ACCEPTED SOLUTION

Accepted Solutions

Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

Hi Laurent,

Apache NiFi 1.4.0 uses Jetty 9.4.2 to provide the underlying web server, and Jetty after versions 9.4.0 only supports TLS v1.2 for incoming connections. I would recommend using a proxy with TLS termination which accepts incoming TLS v1.1 connections and re-establishing a connection to your NiFi service which uses TLS v1.2.

* Ticket - NIFI-3361 Upgrade Jetty https://issues.apache.org/jira/browse/NIFI-3361

* Ticket - NIFI-3720 Update documentation for TLS protocol version changes https://issues.apache.org/jira/browse/NIFI-3720

* Jetty Documentation TLS and SSL Versions https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#tls-and-ssl-versions

* Apache NiFi Release Notes for 1.2.0 noting TLS protocol version changes https://cwiki.apache.org/confluence/display/NIFI/Release+Notes#ReleaseNotes-Version1.2.0

* Apache NiFi Migration Guidance for 1.1.0 -> 1.2.0 noting the change https://cwiki.apache.org/confluence/display/NIFI/Migration+Guidance

The actual announcement that Jetty changed the protocol versions supported is buried in their release notes somewhere.

3 REPLIES 3

Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

Hi Laurent,

Apache NiFi 1.4.0 uses Jetty 9.4.2 to provide the underlying web server, and Jetty after versions 9.4.0 only supports TLS v1.2 for incoming connections. I would recommend using a proxy with TLS termination which accepts incoming TLS v1.1 connections and re-establishing a connection to your NiFi service which uses TLS v1.2.

* Ticket - NIFI-3361 Upgrade Jetty https://issues.apache.org/jira/browse/NIFI-3361

* Ticket - NIFI-3720 Update documentation for TLS protocol version changes https://issues.apache.org/jira/browse/NIFI-3720

* Jetty Documentation TLS and SSL Versions https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#tls-and-ssl-versions

* Apache NiFi Release Notes for 1.2.0 noting TLS protocol version changes https://cwiki.apache.org/confluence/display/NIFI/Release+Notes#ReleaseNotes-Version1.2.0

* Apache NiFi Migration Guidance for 1.1.0 -> 1.2.0 noting the change https://cwiki.apache.org/confluence/display/NIFI/Migration+Guidance

The actual announcement that Jetty changed the protocol versions supported is buried in their release notes somewhere.

Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

New Contributor

Thanks Andy for your very complete answer !

I read that Jetty improved recently the security with TLS 1.2 only (very good !) but I hoped it was possible to force a weak protocol (bad but sometime, it's necessary...).

As you told me, my only choice is the installation of a proxy like HAProxy or Squid !

Re: How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

Laurent, feel free to contact me directly at alopresto@apache.org for further discussion.