[NIFI-1478] Audit SSLContextFactory and SSLSocketFactory usage throughout application

• Type: Improvement
• Status: Resolved
• Priority: Critical
• Resolution: Implemented
• Affects Version/s: 0.5.0
• Component/s: Core Framework
• Labels: certificate security tls
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 04/Feb/16 02:43
• Updated: 06/Apr/21 16:26
• Resolved: 06/Apr/21 16:26

Description

The internal use of SSLSocketFactory and SSLContextFactory is inconsistent, as the application has grown around the concept of secure communications. NiFi can act as both a server and as a client for communications, and the default configuration should make it easy for new users to quickly secure the application for incoming and outgoing connections.

In addition, SSLSocketFactory has some inconsistencies and idiosyncrasies which may confuse users [1].

[1] http://stackoverflow.com/a/23365536/70465

Issue Links

• incorporates: NIFI-5623 Update all usage of Okhttp to latest library
• incorporates: NIFI-1504 InvokeHttp hits NPE if target system doesn't respond with proper HTTPS Headers
• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is depended upon by: NIFI-1995 Support keystores with multiple certificates by exposing alias selection in configuration
• is related to: NIFI-5176 NiFi needs to be buildable on Java 11
• relates to: NIFI-1990 Implement consistent security controls for cluster, site-to-site, and API communications
• relates to: NIFI-2930 SSLContextFactory throws Exception when Keystore password differs from Key password
• relates to: NIFI-1444 PostHTTP cannot work with public HTTPS sites
• relates to: NIFI-1688 PostHTTP does not honor SSLContextService Protocols
• relates to: NIFI-1480 Allow different cipher suites configurable properties for NiFi UI & integrations
• relates to: NIFI-1525 Audit use of private keys throughout application