Support Questions
Find answers, ask questions, and share your expertise

mTLS between minifi and EFM

New Contributor

I'm using self signed certificates for mTLS communication between minifi agents and a stand-alone EFM server. Do I need to put the public keys of each into the others' truststores or is it ok to simply have the root/intermediate CA that was used to sign the public certs in the truststores? So far I haven't been able to establish communication over mTLS for either case, but would like to know so that I can go on and plan on developing infrastructure to automate importing into the EFM truststore all the minifi agent certificates if that is the case. I'm using Cloudera EFM 1.3.1 and Apache minif 1.3.0

 

Thanks,

minh

1 ACCEPTED SOLUTION

Master Collaborator

Hi, @lyminh ,

 

If you using self-signed certificates you typically have to add them to the truststore. When I say "self-signed", it means that the Subject and the Issuer of the certificate are the same.

 

If you have a CA root (without or without the intermediate) your server certificates are *not* self-signed. They are signed by the CA. In this case the only self-signed certificate is the root. In this scenario, you don't need to put the certificates in the truststore; only the Root CA. The *key*store used by EFM and by MiNiFi, should contain the server certificate AND the intermediate certificate (if there's one).

 

HTH,

André

 

--
Was your question answered? Please take some time to click on "Accept as Solution" below this post.
If you find a reply useful, say thanks by clicking on the thumbs up button.

View solution in original post

2 REPLIES 2

Master Collaborator

Hi, @lyminh ,

 

If you using self-signed certificates you typically have to add them to the truststore. When I say "self-signed", it means that the Subject and the Issuer of the certificate are the same.

 

If you have a CA root (without or without the intermediate) your server certificates are *not* self-signed. They are signed by the CA. In this case the only self-signed certificate is the root. In this scenario, you don't need to put the certificates in the truststore; only the Root CA. The *key*store used by EFM and by MiNiFi, should contain the server certificate AND the intermediate certificate (if there's one).

 

HTH,

André

 

--
Was your question answered? Please take some time to click on "Accept as Solution" below this post.
If you find a reply useful, say thanks by clicking on the thumbs up button.

Community Manager

@lyminh, Has @araujo's reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. 



Regards,

Vidya Sargur,
Community Manager


Was your question answered? Make sure to mark the answer as the accepted solution.
If you find a reply useful, say thanks by clicking on the thumbs up button.
Learn more about the Cloudera Community:
; ;