[NIFI-1355] Provide dynamic code-generated certificates for HTTP tests to avoid expiry

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.4.0, 0.4.1
• Fix Version/s: 1.13.0
• Component/s: Core Framework
• Labels: certificate security test
• Assignee: Margot Tien
• Reporter: Andy LoPresto
• Created: 05/Jan/16 21:15
• Updated: 03/Feb/21 22:13
• Resolved: 03/Feb/21 15:10

Description

As documented, the test certificates/keys used in the TestInvokeHttp and TestInvokeHttpSSL tests expired in 2014. With the constant removal of non-certificate based cipher suites from client libraries, the lack of valid certificates meant that the Jetty server could not offer any compatible cipher suites, and the tests failed. I manually generated and loaded new certificates but they expire after 1 year. Adding code to dynamically generate and load these certificates into the keystore and truststore would remove this inconsistent blocker.

Issue Links

• is related to: NIFI-1354 InvokeHTTP test certificates have expired
• is related to: NIFI-5622 Test certificates require SAN values
• links to: GitHub Pull Request #4767
• links to: GitHub Pull Request #4801