Thank you for your answer, it is very helpful, but does bring up some follow up questions. If the client/server mode is designed for the setup of secured clusters, why should the certificate be created in the same server where the CA (tls-toolkit server mode) is running and not in the server that i plan to run my node. Further more, it is very strange that the output of the tls-toolkit (client) requesting for a certificate comes out as a config.json file (containing all the properties that should be configured in the nifi.properties) and it is not possible to configure nifi to read those properties from the config.json file. it seems like its not really built for automatic scaling of nodes, and most times will require the intervention of a person or a 3rd party script to automate that scaling. If all the certificates should created on the same server when running in a client/server architecture, isn't it more beneficial to have one server dedicated for creating certificates, running in standalone mode, so all the certificates are signed by the same CA, while outputting the nifi.propeties file ready to be used for the deployment of the node? Thank You once again, Nimrod
... View more
