mTLS between minifi and EFM

[#1]

I'm using self signed certificates for mTLS communication between minifi agents and a stand-alone EFM server. Do I need to put the public keys of each into the others' truststores or is it ok to simply have the root/intermediate CA that was used to sign the public certs in the truststores? So far I haven't been able to establish communication over mTLS for either case, but would like to know so that I can go on and plan on developing infrastructure to automate importing into the EFM truststore all the minifi agent certificates if that is the case. I'm using Cloudera EFM 1.3.1 and Apache minif 1.3.0

Thanks,

minh

[#2 · Accepted solution]

Hi, @lyminh ,

If you using self-signed certificates you typically have to add them to the truststore. When I say "self-signed", it means that the Subject and the Issuer of the certificate are the same.

If you have a CA root (without or without the intermediate) your server certificates are *not* self-signed. They are signed by the CA. In this case the only self-signed certificate is the root. In this scenario, you don't need to put the certificates in the truststore; only the Root CA. The *key*store used by EFM and by MiNiFi, should contain the server certificate AND the intermediate certificate (if there's one).

HTH,

André

[#3]

@lyminh, Has @araujo's reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.