Looking for details for generating client certificate when not using NiFi CA

[#1]

Hi, we are installing HDF 2 using Ambari and in the step to secure nifi. We have generated certificate and not using NiFi CA.

Trying to follow instructions here:

https://community.hortonworks.com/articles/58009/hdf-20-enable-ssl-for-apache-nifi-from-ambari.html

and here:

http://docs.hortonworks.com/HDPDocuments/HDF2/HDF-2.0.1/bk_ambari-installation/content/generating-cl...

The instructions are specific to using NiFi CA and am having trouble in understanding what to do if we are not using NiFi CA. We also want to use LDAP authentication which we had done on a standalone nifi instance and are hoping to do the same with this cluster instance. Our installation of nifi through ambari does work in non ssl mode.

Any help/direction is appreciated.

[#2 · Accepted solution]

If you are not using the NiFi CA, you can still secure your HDF instances by providing each with resources meeting the following requirements:

• Keystore
  • The keystore must contain a PrivateKeyEntry containing the private key and public certificate with valid dates and a DN matching the fully-qualified domain name (FQDN) of the host, and if signed by another key, the public certificate of that resource
• Truststore
  • The truststore must contain a trustedCertEntry containing the public certificate of each authorized user or the CA used to sign the individual certificates.
• The nifi.properties file must contain the path to each keystore and truststore and the corresponding password to access each.

To configure LDAP authentication, you follow the same steps as for a standalone instance. The nifi.properties and login-identity-providers.xml files must be synchronized to all nodes in the cluster.

[#3]

Hi Alo,

We did the SSL on Nifi server with CA signed certificates but not Nifi CA.

I now want to create once client certificate to authenticate to Nifi can you please help me outline the steps.