[NIFI-13941] Correct Maximum DNS Name Length for Generated Certificates

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 28/Oct/24 18:19
• Updated: 28/Oct/24 20:41
• Resolved: 28/Oct/24 20:41

Description

The nifi.web.proxy.host property provides optional DNS names for NiFi running behind a reverse proxy or gateway, and the automated certificate generation process considers property values when adding DNS Subject Alternative Names.

Recent updates to remove the optional port element set a maximum length of 64 characters for the entire DNS address, which is the limit for a label, but an not the entire address according to RFC 1035. The length limitation should be changed to 255 as described in RFC 1035 Section 2.3.4.

Issue Links

• is caused by: NIFI-13823 Inconsistency between nifi.web.proxy.host format and TLS SubjectAlternativeNames
• links to: GitHub Pull Request #9462