[NIFI-13987] Use SSL Context Service in GitHubFlowRegistryClient and GitLabFlowRegistryClient

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.0.0
• Component/s: Extensions
• Labels: certificate client git github gitlab https registry ssl
• Assignee: Unassigned
• Reporter: René Zeidler
• Created: 08/Nov/24 08:53
• Updated: 08/Nov/24 09:53

Description

The Git Flow Registry Clients currently don't use the SSL Context Service. It always uses the default Java truststore for certificate validation, which prevents the use of privately hosted GitHub/GitLab instances without a public certificate.

Adding a configurable SSL Context Service would allow using a custom truststore, as is the case for most other NiFi components using SSL.

Workaround

Custom certificates can be added to the default Java truststore using:

keytool -cacerts -importcert -noprompt -file /path/to/custom/ca.cert

This will affect all SSL connections not using a custom truststore, including those made by the Git registry clients.