[NIFI-1995] Support keystores with multiple certificates by exposing alias selection in configuration

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.6.1
• Component/s: Core Framework
• Labels: certificate keystore security
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 10/Jun/16 00:43
• Updated: 05/May/20 20:53

Description

Some users and organizations would like to provide different certificates for identification of the same NiFi instance when acting in different roles (for example, one certificate to identify the server for the API / UI interaction, and another to identify the server in cluster communications and/or site-to-site communications). A preliminary list of roles is:

• API / UI host
• remote authorization / authentication repositories (communicating with Ranger, LDAP, KDC, etc.)
• cluster (node/NCM/Zookeeper)
• site-to-site
• client when connecting to remote services during data flow (InvokeHTTP, PutSQL, etc.)

This should be implemented in a manner that does not break the default operation (i.e. a keystore with a single certificate value) but allows easy overriding for one or more of the roles listed above.

Issue Links

• depends upon: NIFI-1478 Audit SSLContextFactory and SSLSocketFactory usage throughout application
• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is depended upon by: NIFI-5586 Add capability to generate ECDSA keys to TLS Toolkit
• is related to: NIFI-1990 Implement consistent security controls for cluster, site-to-site, and API communications
• is related to: NIFI-1981 Cluster communication requires client certificates even if needClientAuth set to false
• relates to: NIFI-3890 Create Key Management Controller Service