Upgrading to NiFi version - 1.11.3 Issue - SSL Mutual authentication issue Currently using NiFi - 1.9.0 and implemented SSL mutual authentication and its working fine. I am trying to upgrade to a newer version and i have installed 1.11.3 version in the parallel mode on the same server where 1.9.0 is installed in different port. For the newer version i am using the same keystore and truststore along with the client certificates, basically i have just copied these from 1.9.0 version. when i am trying to access the webgui i am getting javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target But when i run the crul command i am getting the response from the URL curl --insecure -v --cert-type P12 --cert cert.p12:[passkey] https://nifisitapp01.XXXXX.com:7081/nifi/ output * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt CApath: none * TLSv1.2 (OUT), TLS header, Certificate Status (22): } [5 bytes data] * TLSv1.2 (OUT), TLS handshake, Client hello (1): } [512 bytes data] * TLSv1.2 (IN), TLS handshake, Server hello (2): { [85 bytes data] * TLSv1.2 (IN), TLS handshake, Certificate (11): { [4337 bytes data] * TLSv1.2 (IN), TLS handshake, Server key exchange (12): { [333 bytes data] * TLSv1.2 (IN), TLS handshake, Request CERT (13): { [1240 bytes data] * TLSv1.2 (IN), TLS handshake, Server finished (14): { [4 bytes data] * TLSv1.2 (OUT), TLS handshake, Certificate (11): } [1706 bytes data] * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): } [70 bytes data] * TLSv1.2 (OUT), TLS handshake, CERT verify (15): } [264 bytes data] * TLSv1.2 (OUT), TLS change cipher, Client hello (1): } [1 bytes data] * TLSv1.2 (OUT), TLS handshake, Finished (20): } [16 bytes data] * TLSv1.2 (IN), TLS change cipher, Client hello (1): { [1 bytes data] * TLSv1.2 (IN), TLS handshake, Finished (20): { [16 bytes data] * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-SHA384 * ALPN, server did not agree to a protocol * Server certificate: * subject: C=XX; ST=XXXX; L=XXXX; O=SOME ORGANIZATION; OU=X OPERATIONAL UNIT; CN=nifisitapp01.XXXXX.com * start date: Jul 23 06:36:29 2019 GMT * expire date: Jul 21 06:36:29 2024 GMT * issuer: DC=COM; DC=XCOMPANY; DC=UAT; CN=XCompany Issuing CA * SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway. } [5 bytes data] > GET /nifi/ HTTP/1.1 > Host: nifisitapp01.XXXXX.com:7081 > User-Agent: curl/7.47.1 > Accept: */* > { [5 bytes data] < HTTP/1.1 200 OK < Date: Tue, 24 Mar 2020 10:27:57 GMT < X-Frame-Options: SAMEORIGIN < Content-Security-Policy: frame-ancestors 'self' < X-XSS-Protection: 1; mode=block < Strict-Transport-Security: max-age=31540000 < Content-Type: text/html;charset=utf-8 < Vary: Accept-Encoding, User-Agent < Transfer-Encoding: chunked < Server: Jetty(9.4.19.v20190610) < { [16037 bytes data] I am not able to figure out what is actually missing, is it that browser i not passing the right certificate to the server ? Please share your inputs. Thank you
... View more
