[NIFI-11015] registry ApplicationServerConnectorFactory uses NiFiRegistryProperties.SECURITY_KEYSTORE_TYPE instead of NiFiRegistryProperties.SECURITY_TRUSTSTORE_TYPE for buildTrustStore

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.19.0, 1.19.1
• Fix Version/s: 1.20.0
• Component/s: NiFi Registry
• Assignee: David Handermann
• Reporter: lucas theisen
• Created: 28/Dec/22 16:24
• Updated: 31/Dec/22 09:34
• Resolved: 31/Dec/22 09:34

Description

Our server has been configured to use PKCS12 for the keystore and JKS for the truststore, but when we attempted to upgrade (from 1.16 to 1.19.1) the registry fails to start with:

2022-12-28 15:33:01,442 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut 2022-12-28 15:33:01,442 INFO [main] org.eclipse.jetty.util.log Logging initialized @632ms to org.eclipse.jetty.util.log.Slf4jLog
2022-12-28 15:33:01,533 ERROR [NiFi logging handler] org.apache.nifi.registry.StdErr Failed to start web server: Key Store loading failed
2022-12-28 15:33:01,533 ERROR [NiFi logging handler] org.apache.nifi.registry.StdErr Shutting down...
2022-12-28 15:33:01,534 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut 2022-12-28 15:33:01,534 WARN [main] o.apache.nifi.registry.jetty.JettyServer Failed to start web server... shutting down.
2022-12-28 15:33:01,534 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut org.apache.nifi.security.ssl.BuilderConfigurationException: Key Store loading failed
2022-12-28 15:33:01,534 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.security.ssl.StandardKeyStoreBuilder.build(StandardKeyStoreBuilder.java:56)
2022-12-28 15:33:01,534 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.jetty.connector.ApplicationServerConnectorFactory.buildStore(ApplicationServerConnectorFactory.java:181)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.jetty.connector.ApplicationServerConnectorFactory.buildTrustStore(ApplicationServerConnectorFactory.java:167)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.jetty.connector.ApplicationServerConnectorFactory.buildSslContext(ApplicationServerConnectorFactory.java:141)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.jetty.connector.ApplicationServerConnectorFactory.<init>(ApplicationServerConnectorFactory.java:74)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.jetty.JettyServer.configureConnectors(JettyServer.java:150)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.jetty.JettyServer.<init>(JettyServer.java:101)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.NiFiRegistry.<init>(NiFiRegistry.java:114)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.registry.NiFiRegistry.main(NiFiRegistry.java:168)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut Caused by: java.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at sun.security.util.DerInputStream.getLength(DerInputStream.java:588)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at sun.security.util.DerValue.init(DerValue.java:412)
2022-12-28 15:33:01,535 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at sun.security.util.DerValue.<init>(DerValue.java:353)
2022-12-28 15:33:01,545 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at sun.security.util.DerValue.<init>(DerValue.java:366)
2022-12-28 15:33:01,545 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1946)
2022-12-28 15:33:01,545 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at java.security.KeyStore.load(KeyStore.java:1445)
2022-12-28 15:33:01,545 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     at org.apache.nifi.security.ssl.StandardKeyStoreBuilder.build(StandardKeyStoreBuilder.java:54)
2022-12-28 15:33:01,545 INFO [NiFi logging handler] org.apache.nifi.registry.StdOut     ... 8 common frames omitted

A quick check of the source shows the use of NiFiRegistryProperties.SECURITY_KEYSTORE_TYPE instead of NiFiRegistryProperties.SECURITY_TRUSTSTORE_TYPE:

    private KeyStore buildTrustStore(final NiFiRegistryProperties properties) {
        final String trustStore = getRequiredProperty(properties, NiFiRegistryProperties.SECURITY_TRUSTSTORE);
        final String trustStoreType = getRequiredProperty(properties, NiFiRegistryProperties.SECURITY_KEYSTORE_TYPE);
        final String trustStorePassword = getRequiredProperty(properties, NiFiRegistryProperties.SECURITY_TRUSTSTORE_PASSWD);
        return buildStore(trustStore, trustStoreType, trustStorePassword);
    }

This means that to workaround this in the current code we will need to use the same keystore type for both the keystore and the trust store and use the nifi.registry.security.keystoreType to configure that type.

Issue Links

• is caused by: NIFI-10625 Add HTTP/2 Support to Registry Server
• links to: GitHub Pull Request #6815