From our experience, if you are going to setup SSL, you Must setup the Authorization services first.
If you are going to try to leverage Ranger to do the authentication/authorizations, you will find you need SSL setup first.
So, to do that, you must set up the Authorizations to another source before attempting to enable SSL. You will get very interesting messages if you don't, and could end up spending days on a wrong path troubleshooting those.
The error you are seeing, is because of the intra-cluster communications identifying itself as the DN (from the ssl key).
The Node Identity is not yet setup, and that is the error you are getting.
The instructions provided above (by mclark) assume that you are going to have a unique key per server, and would use the CN for each server to identify the Node.
It is possible to have just 1 key used on all nodes though. In that case, you would just set 1 Node Identity, and use that DN. So, if you are gettting
Untrusted proxy EMAILADDRESS=NIFI-support@apache.com, CN=vanityalias.mycompany.com, OU=Tech, O=NIFI Services, L=City, ST=STATE, C=US
Then, your node identity in the authorizers.xml would be set to
<property name="Node Identity 1">EMAILADDRESS=NIFI-support@apache.com, CN=vanityalias.mycompany.com, OU=Tech, O=NIFI Services, L=City, ST=STATE, C=US</property>
If you have a key per server, just add the DN for each key to the appropriate Node Identity in that file.
I highly recommend reading Bryan's blog around "apache-nifi-1-0-0-authorization-and-multi-tenancy" if you are reading this comment.
... View more
