Our Community is getting an upgrade! To get everything ready for the relaunch, we’ll be placing the site in read-only mode starting September 21st.
We really appreciate your understanding while we get things set up behind the scenes. Catch up on all the exciting details about the move here.
Need help or have questions? Drop us a line at [email protected]

Support Questions

Find answers, ask questions, and share your expertise
Announcements
Share your experience with Cloudera on G2 and get a $25 Amazon Gift card.
Hi, I'm CLEO! Something exciting is coming to the Community. Stay Tuned!

Not valid SSL Certificate

avatar
New Contributor

Hello, I could use some help...

 

I'm using GetHTTP and InvokeHTTP processors for reading certain indices in a elasticsearch database. The URL to this database is a HTTPS, my question is the following: Is it possible to run these processors leaving the SSL Context Service property as "No value" when you insert in the URL property a HTTPs?

 

If I do this I get the following error (InvokeHTTP processor):

 
InvokeHTTP[id=0e07115a-102e-1182-be33-467ed7f3f784] Yielding processor due to exception encountered as a source processor: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target: {}

 

If I run a GET to this URL in postman with "Enable SSL certificate verification"=OFF it works. However, taking a look at the error It looks like Nifi requires the SSL certificate. 

 

The problem is that if I download the certificate and import it as a trusted certificate in the KeyStore Explorer and use the SSL Context Service property I get the following error in Nifi:

 

InvokeHTTP[id=01821018-0e07-1153-5966-62a9d2f5c98e] Yielding processor due to exception encountered as a source processor: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
- Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target: {}

 

This might be because the site is not safe and the downloaded certificate is not valid. I get the following alert when I introduce the URL in my search engine: Not trusted certificate.

 

Angelvillar_1-1661431638958.png

 

 Is there any way to solve this problem? How can I perform a GET in Nifi to an HTTPs without the SSL certificate?

 

Many thanks in advance for the help.

 

 

2 REPLIES 2

avatar
New Contributor

The security overview of the page is the following:

Angelvillar_0-1661513634138.png

 

I would really appreciate some help

avatar

@Angelvillar I would recommend that you create a SSL Context Service using javas cacerts as the keystore and truststore.   If that doesnt work,  THEN, try to make your own with the certs from the ELK server.

 

Here is a similar post with a lot more details of how that looks with cacerts and details for alternative custom keystore/trustore.

 

 

https://community.cloudera.com/t5/Support-Questions/Configure-StandardSSLContextService-for-Elastics...