Skip to main content
sandip87
sandip87
Silver ⭐️⭐️
November 1, 2021
Question

Unable to secure NiFi with provided certificates

Hi,

 

I was able to setup a secure NiFi cluster with two nodes on two different AWS EC2 linux instances using the certificate generated using NiFi toolkit but I am not able to secure it with company provided certificates. I followed this article - https://nifi.apache.org/docs/nifi-docs/html/walkthroughs.html#securing-nifi-with-provided-certificates and was able to execute all steps on one of the nodes and tried to access the UI shutting down the other node but still I get below error - <server name> didn't accept your login certificate, or a login certificate may not have been provided. ERR_BAD_SSL_CLIENT_AUTH_CERT

 

Can you please suggest what can be done to address this issue or point to some walkthrough article other than the link I mentioned above where the enterprise provided certificate has been deployed successfully.

7 replies

MattWho
Titanium ⭐️⭐️⭐️
MattWho
Titanium ⭐️⭐️⭐️
November 2, 2021

@sandip87 

Without the detailed output of your NiFi keystore and truststore and the of your client certificate you are using to authenticate yourself to NiFi, it would be difficult to say exactly where your issue is.  I am leaning towards and issue with your company issued certificates because you stated the this same NiFi worked fine when using certificates and keystores generated by NiFi's TLS toolkit.

For NiFi's keystore (configured in nifi.properties file), make sure the following are correct:
1. keystore contains 1 and only 1 PrivateKeyEntry
2. Make sure the PrivateKeyEntry ExtendedKeyUsage (EKU) contains clientAuth and serverAuth
3. Make sure that the PrivateKeyEntry contains a SAN entry that matches the hostname of the host where NiFi is running.

For the user certificate loaded in the browser being used to authenticate with this NiFi:
1. verify certificate issuer.  Is it an intermediate CA or the root CA?
2. Verify the NiFi's truststore.jks (configured in nifi.properties file) contains aTrustedCertEntry for the complete trust chain that goes with your certificate and the certificate found in the keystore.jks.  A complete trust chain means that the truststore has the public keys for the issuer of each of the above certificates and if that issuer is and intermediate CA, you also have the public certificate for the CA that signed that intermediate CA in the truststore.   You'll know when you have reached the root CA when the TrustedCertEntry has the same DN for both owner and issuer.

Your browser must also contain the complete trusts chain for the certificates issued to your NiFi nodes.

Once all the above is verified, clear your browser cache and site cookies.

If you still have same issue and you are using Chrome browser, try typing "thisisunsafe" (which tells chrome to skip certificate verification on the certificate presented from the NiFi instance) while the NiFi chrome tab is in focus.  If this works and allows you to proceed, this again points at a trust issue between your corporately issued certificate and your browser. Go back and verify structure/content of the NiFi keystore again.

If you found this response assisted with your query, please take a moment to login and click on "Accept as Solution" below this post.

Thank you,

Matt

Translate
sandip87
sandip87Author
Silver ⭐️⭐️
November 5, 2021

Hi Matt,

 

Thank you very much for the detailed response. As I don't have much knowledge about these security configurations, I have set the keystore and truststore password to be same and without the hostname. Would you able to provide the reference to the lines in the nifi.properties file which refer to the three things you mentioned in your response:

 

For NiFi's keystore (configured in nifi.properties file), make sure the following are correct:
1. keystore contains 1 and only 1 PrivateKeyEntry
2. Make sure the PrivateKeyEntry ExtendedKeyUsage (EKU) contains clientAuth and serverAuth
3. Make sure that the PrivateKeyEntry contains a SAN entry that matches the hostname of the host where NiFi is running.

 

Kind regards,

Sandip

Translate
MattWho
Titanium ⭐️⭐️⭐️
MattWho
Titanium ⭐️⭐️⭐️
November 8, 2021

@sandip87 

 

The following properties within the nifi.properties file will tell you where your NiFi's keystore and truststore files are located:

1. nifi.security.keystore

2. nifi.security.truststore

 

You can use the java keytool command to see the verbose details of the content of these two keystores:

<path to java JDK>/bin/keytool -v -list -keystore <keystore/truststore>

 

Once you inspect the these to make sure the contents are good, then you need to make sure you can successfully authenticate your user in to your NiFi.

By default once NIFi is secured, the only method to authenticate a user/client is via a mutual TLS handshake which means your user needs to have a certificate loaded in the browser.

Optionally you can add additional user authentication methods if you want.
https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#user_authentication

 

 

Translate
dimi_yu
dimi_yu
Silver ⭐️⭐️⭐️
July 22, 2025

The error ERR_BAD_SSL_CLIENT_AUTH_CERT is a security-related bug that appears in web browsers, especially Google Chrome, due to a failure to interact with the SSL/TLS client authentication process. 

This issue arises when SSL/TLS certificates are required on both client and server sides, but the client fails to present a valid certificate or the server can't verify it. Common causes include certificate misconfiguration, incorrect device date/time, software issues, or interference from browser extensions and antivirus programs. There are many different ways to fix the error which you need to understand properly in detail. Furthermore I found the helpful resource at:-  https://cheapsslweb.com/resources/how-to-fix-the-err_bad_ssl_client_auth_cert-error.

I hope it helps!

 
 
Translate
Terms & ConditionsAccessibility statement