NIFI SSL Keystore and Truststore Generation Workflow

Design for Keystore and Truststore Generation

Generation Procedure

Perform the below steps for the generation procedure:

Not Enabled SSL

If the User does not enable SSL, TLS state management for the NIFI UI will involve the generation of a Keystore and Truststore. These can be generated by a Certificate Authority (CA) if enabled; otherwise, they will be generated using our custom script.

Enabled SSL

When SSL is enabled by the User, self-signed certificates and private keys, along with Keystore and Truststore, will be created using the tls-toolkit if a Certificate Authority (CA) is enabled. Alternatively, these components will be generated by our custom script if CA is not enabled.

Troubleshooting

When generating Keystore and Truststore using self-signed Certificates, it's essential to ensure that both the root directory and its subdirectories, where these files are located, are accessible by the NiFi user. Below is a stack trace that may occur if the directory containing the Keystore and Truststore is not accessible by the NiFi user.

Temporary Solution

You can manually adjust the permissions using chown and chmod to grant access to the NiFi user.

Caused by: java.lang.IllegalStateException: Error configuring TLS for state manager
at org.apache.nifi.controller.state.manager.StandardStateManagerProvider.createStateProvider(StandardStateManagerProvider.java:222)
at org.apache.nifi.controller.state.manager.StandardStateManagerProvider.createLocalStateProvider(StandardStateManagerProvider.java:127)
at org.apache.nifi.controller.state.manager.StandardStateManagerProvider.create(StandardStateManagerProvider.java:107)
at org.apache.nifi.cluster.coordination.node.NodeClusterCoordinator.<init>(NodeClusterCoordinator.java:134)
at org.apache.nifi.cluster.spring.NodeClusterCoordinatorFactoryBean.getObject(NodeClusterCoordinatorFactoryBean.java:54)
at org.apache.nifi.cluster.spring.NodeClusterCoordinatorFactoryBean.getObject(NodeClusterCoordinatorFactoryBean.java:35)
at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:169)
... 115 common frames omitted
Caused by: org.apache.nifi.security.util.TlsException: The truststore properties are not valid

When generating Keystore and Truststore using self-signed Certificates, it's crucial to ensure that there is a Subject Alternative Name (SAN) entry for the host signing the certificate. Failure to include this entry may result in the following errors during communication between Ranger and NiFi.

Certificate has no SAN entry	HTTP status code & Ranger Log
Ranger & Nifi are on same host	500 [Ranger Log: hostname should be xxxx ]
Ranger & Nifi are on different host	500, 403(More common) Ranger Log: Uauth [Ranger Log: hostname should be xxxx ]

Certificate has no SAN entry

HTTP status code & Ranger Log

Ranger & Nifi are on same host

500 [Ranger Log: hostname should be xxxx ]

Ranger & Nifi are on different host

500, 403(More common)

Ranger Log: Uauth

[Ranger Log: hostname should be xxxx ]

Additionally, verify that if you are using Keystore and Truststore to establish a connection with Ranger, these files (keystore.jks and truststore.jks) have execution permissions. These permissions are necessary when these files are utilized as a client during the connection with the NiFi server.

Best Practices while Generating Keystore & Truststore with a self-signed certificate

Perform the following:

Create a CA key pair and a self-signed certificate.
Generate a server key pair with extensions.
Generate a CSR with extensions.
Sign the CSR with the CA from step one.
Import the root CA certificate and the signed certificate into the server keystore.
Import the root CA certificate into a new truststore.

Default Installation Steps

Here are the default settings for self-generated certificates, Keystore, and Truststore. Custom paths and values for Keystore and Truststore are also supported, but ensure that their values are accurate before proceeding.

CA Enabled

keystore default path : {{nifi_config_dir}}/auth/<hostname>/keystore.jks
keystorepassword : <custom-password-you-want>
truststore default path : {{nifi_config_dir}}/Auth/<hostname>/truststore.jks
truststorepassword : <custom-password-you-want>
The above generates the following files and folders in the auth folder:

File: CN=<hostname>_OU=NIFI.p12
File: CN=<hostname>_NIFI.password
Folder: sehajnewcentos
|-- keystore.jks
|-- nifi.properties
`-- truststore.jks
File: nifi-cert.pem
File: nifi-key.key

CA Disabled

Note

Ensure to remove the host name if added.

keystore default path : {{nifi_config_dir}}/auth/keystore.jks
keystorepassword : <custom-password-you-want>
truststore default path : {{nifi_config_dir}}/Auth/truststore.jks
truststorepassword : <custom-password-you-want>

The above generates the following files in the Auth folder:

File: ca.crt
File: ca.key
File: keystore.jks
File: truststore.jks
File: server.csr
File: server.signed.crt