[NIFI-11536] nifi.security.autoreload.enabled is broken since v1.17.0

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.17.0, 1.18.0, 1.19.0, 1.20.0
• Fix Version/s: 2.0.0-M1, 1.23.0
• Component/s: Security
• Labels: critical
• Environment: standalone
• Assignee: Emilio Setiadarma
• Reporter: Tan Luu
• Created: 10/May/23 02:04
• Updated: 10/Jul/23 16:09
• Resolved: 10/Jul/23 16:09

Description

NiFi standalone with nifi.security.autoreload.enabled=true does not reload TLS keystore after upgrade from 1.16.3 to 1.17.0 onward.

Steps to reproduce:

1/ Generate truststore and 2 keystores for nifi standalone using nifi toolkit. Two keystores should be generated at least 5 minutes apart from each other since we use the certificate start time to verify if the new cert is loaded later

e.g.

bin/tls-toolkit.sh standalone -n nifi.tmanet.com \
--subjectAlternativeNames nifi.tmanet.com -P TErbdTQutLvFVd3kunMcCL5/OG1K+t2l/Q1vSiJbJp8 \
-S JaTxUVN+HK8+LyPCs9ruJXCiYq/zr1bYUxJBjEGnjpw

2/ Configure nifi standalone with generated truststore and one of the keystore then start nifi (ensure nifi.security.autoreload.enabled=true in your nifi.properties)

3/ Check the certificate start date return when calling nifi url e.g. nifi.tmanet.com:9443

curl -kv https://nifi.tmanet.com:9443 2>&1 | /bin/grep start

4/ Replace keystore.jks by another keystore generated above and wait for nifi.security.autoreload.interval (default 10s) and recheck the nifi certificate by 

curl -kv https://nifi.tmanet.com:9443 2>&1 | /bin/grep start

Issue Links

• is related to: NIFI-10425 nifi.security.autoreload.enabled feature doesn't work with symlink
• links to: GitHub Pull Request #7446