Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Nifi registry issue with https

avatar

I have enabled https on nifi registry properties and generated key store and trust store using tls toolkit and added in the properties file. I am able to start nifi registry on port 18443 and host 0.0.0.0 as it showing in logs that jetty server started on https://0.0.0.0:18443/nifi registry

my nifi registry is hosted as aks pod. 
when I enable ingress for it. It’s returning me as 502 bad request.

are there any changes to be done to make my nifi registry run https.

 

Goal : i want to enable 2 way ssl authentication so that nifi could connect to nifi registry.

2 ACCEPTED SOLUTIONS

avatar
Super Mentor

@Knowledgeknow 

I am not clear here:
when I enable ingress for it. It’s returning me as 502 bad request

NiFi-Registry is secured once configured with an HTTPS hostname, HTTPS port, keystore, and truststore.  For more info: security_configuration 

As soon as HTTPS is enabled, TLS/SSL is used. It is either enabled as "REQUIRED" or "WANT", but can not be set to "NONE".   This is controlled by 
nifi.registry.security.needClientAuth=true (default) 
With "true" being "Required" and false being "Want"

In order for NiFi to be able to successfully negotiate a mutual TLS handshake, the NiFi "registry client" must use the HTTPS nifi-registry "https://<nifi-registry hostname>:<port> url and have either the keystore and truststore configured in nifi.properties or a  StandardRestrictedSSLContextService configured with valid keystore and truststore.

The NiFi-registry keystore must:
- Contain a single PrivateKeyEntry
- PrivateKey entry has serverAuth EKU
- PrivateKey Entry has SAN entries that include any hostname and IPs that client(s) may use to connect to it.  Since you have configured hostname with 0.0.0.0 so that NiFi-Registry binds to all NICs, you'll need to make sure valid network IPs and hostnames are in the SAN.

The NiFi-Regsitry truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi keystore being used by the NiFi Registry Client.

The NiFi keystore must:
- Contain only one PrivateKey Entry.
- PrivateKey DN must not use wildcards
- PrivateKey Entry MUST have both clientAuth and ServerAuth EKU
- PrivateKey Entry must have SAN entries for NiFi hostname, and IPs clients may use to connect to it.

The NiFi truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi-Registry keystore configured in the nifi-registry.properties file.

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

View solution in original post

avatar
Super Mentor

@Knowledgeknow 

  1. Does your NiFi Keystore meet the following requirements?
  • MUST contain only one PriavteKey Entry
  • PrivateKey Entry must include ExtenedKeyUsage(EKU) for both clientAuth and serverAuth.
  • PrivateKey Entry DistinquishedName (DN) does not contain wildcards
  • PrivateKey Entry contains one of more SubjectAlternativeName (SAN) entries that includes the hostname and IP for the NiFi server on which it will be used.

2. Sounds like you have configured nifi.properties:

nifi.remote.input.host=0.0.0.0

While this will work for a http setup, it will cause issue with the TLS handshake.  Instead this should set the hostname of the NiFi server and the hostname must be a SAN entry.  If you are trying to have your NIFi bind to multiple Network Interface Cards (NICs) then you should use the "nifi.web.https.network.interface*" properties in web properties section of the nifi.properties file.

MattWho_0-1698844519875.png

 

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

View solution in original post

11 REPLIES 11

avatar
Super Mentor

@oneofthemany 
You would get better traction form the community by starting a new question since this question already has an accepted solution and has nothing to do with NiFi TLS-toolkit usage.


Thank you,
Matt

avatar
New Contributor