How to force TLS1.1 for HandleHTTPRequest with NiFi 1.4 ?

[#1]

Hello everyone,

I'm using NiFi 1.4 and I'm trying to accept Protocol TLS1.1 for the HandleHTTPRequest processor (thanks to StandardSSLContextService) but only TLS 1.2 is accepted.

How to force the protocol TLS 1.1 ? I already try something like "java.arg.16=-Ddeployment.security.TLSv1.1=true" in the bootstrap.conf but nothing changed.

Have you an idea ?!

Thanks for your help.

Laurent

[#2 · Accepted solution]

Hi Laurent,

Apache NiFi 1.4.0 uses Jetty 9.4.2 to provide the underlying web server, and Jetty after versions 9.4.0 only supports TLS v1.2 for incoming connections. I would recommend using a proxy with TLS termination which accepts incoming TLS v1.1 connections and re-establishing a connection to your NiFi service which uses TLS v1.2.

* Ticket - NIFI-3361 Upgrade Jetty https://issues.apache.org/jira/browse/NIFI-3361

* Ticket - NIFI-3720 Update documentation for TLS protocol version changes https://issues.apache.org/jira/browse/NIFI-3720

* Jetty Documentation TLS and SSL Versions https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#tls-and-ssl-versions

* Apache NiFi Release Notes for 1.2.0 noting TLS protocol version changes https://cwiki.apache.org/confluence/display/NIFI/Release+Notes#ReleaseNotes-Version1.2.0

* Apache NiFi Migration Guidance for 1.1.0 -> 1.2.0 noting the change https://cwiki.apache.org/confluence/display/NIFI/Migration+Guidance

The actual announcement that Jetty changed the protocol versions supported is buried in their release notes somewhere.

[#3]

Thanks Andy for your very complete answer !

I read that Jetty improved recently the security with TLS 1.2 only (very good !) but I hoped it was possible to force a weak protocol (bad but sometime, it's necessary...).

As you told me, my only choice is the installation of a proxy like HAProxy or Squid !

[#4]

Laurent, feel free to contact me directly at alopresto@apache.org for further discussion.