[NIFI-10929] NiFi generated certificates (e.g. Single User, or nifi-toolkit) are not compatible with OpenSSL 3.x+

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.19.0, 1.19.1
• Fix Version/s: 1.20.0
• Assignee: David Handermann
• Reporter: Chris Sampson
• Created: 02/Dec/22 09:41
• Updated: 02/Feb/23 19:03
• Resolved: 24/Jan/23 17:38

Description

The certificates (keystore, truststore) generated by NiFi are not compatible with OpenSSL 3+ because they are created using old/insecure algorithms.

When starting NiFi 1.19.0 (using the apache/nifi Docker image) and confguring a single-user auth, which is the default for NiFi, the generated truststore.p12 and keystore.p12 cannot be decrypted (e.g. to extract the public cert/private key into PEM format files so they can be used with curl) using the OpenSSL version present within the Docker Image.

OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)

Attempted command:

openssl pkcs12 -in "truststore.p12" -out "nifi-cert.pem" -cacerts -nokeys -password "pass:${TRUSTSTORE_PASSWORD}"

Error:

4047C0AF997F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:349:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

This can be worked around by adding the -legacy flag to the openssl command (see this Stack Overflow answer).

Using the command suggested from the linked article, we see that the NiFi generated truststure uses:

PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 51200

Issue Links

• is fixed by: NIFI-10932 NiFi Toolkit CLI cannot connect to NiFi - trustAnchors parameter must be non-empty
• relates to: NIFI-11133 TLS Toolkit Standalone Mode Sets Null Password for Client Keys