Nifi registry issue with https

[#1]

I have enabled https on nifi registry properties and generated key store and trust store using tls toolkit and added in the properties file. I am able to start nifi registry on port 18443 and host 0.0.0.0 as it showing in logs that jetty server started on https://0.0.0.0:18443/nifi registry

my nifi registry is hosted as aks pod. 
when I enable ingress for it. It’s returning me as 502 bad request.

are there any changes to be done to make my nifi registry run https.

Goal : i want to enable 2 way ssl authentication so that nifi could connect to nifi registry.

[#2 · Accepted solution]

@Knowledgeknow 

I am not clear here:
when I enable ingress for it. It’s returning me as 502 bad request

NiFi-Registry is secured once configured with an HTTPS hostname, HTTPS port, keystore, and truststore.  For more info: security_configuration 

As soon as HTTPS is enabled, TLS/SSL is used. It is either enabled as "REQUIRED" or "WANT", but can not be set to "NONE".   This is controlled by 
nifi.registry.security.needClientAuth=true (default) 
With "true" being "Required" and false being "Want"

In order for NiFi to be able to successfully negotiate a mutual TLS handshake, the NiFi "registry client" must use the HTTPS nifi-registry "https://<nifi-registry hostname>:<port> url and have either the keystore and truststore configured in nifi.properties or a  StandardRestrictedSSLContextService configured with valid keystore and truststore.

The NiFi-registry keystore must:
- Contain a single PrivateKeyEntry
- PrivateKey entry has serverAuth EKU
- PrivateKey Entry has SAN entries that include any hostname and IPs that client(s) may use to connect to it.  Since you have configured hostname with 0.0.0.0 so that NiFi-Registry binds to all NICs, you'll need to make sure valid network IPs and hostnames are in the SAN.

The NiFi-Regsitry truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi keystore being used by the NiFi Registry Client.

The NiFi keystore must:
- Contain only one PrivateKey Entry.
- PrivateKey DN must not use wildcards
- PrivateKey Entry MUST have both clientAuth and ServerAuth EKU
- PrivateKey Entry must have SAN entries for NiFi hostname, and IPs clients may use to connect to it.

The NiFi truststore must:
- Contain the complete trust chain capable of establish trust for the PriavteKey in the NiFi-Registry keystore configured in the nifi-registry.properties file.

If you found any of the suggestions/solutions provided helped you with your issue, please take a moment to login and click "Accept as Solution" on one or more of them that helped.

Thank you,
Matt

[#3]

@oneofthemany 
You would get better traction form the community by starting a new question since this question already has an accepted solution and has nothing to do with NiFi TLS-toolkit usage.


Thank you,
Matt

[#4]

thanks, I have created a new post:

https://community.cloudera.com/t5/Support-Questions/NiFi-SAN-IP-using-toolkit-NiFI-Registry/td-p/383...