[NIFI-3691] Provide utility to verify configured security settings and certificates

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Component/s: Configuration
• Labels: certificate keystore security tls-toolkit
• Assignee: Unassigned
• Reporter: Aldrin Piri
• Created: 11/Apr/17 12:53
• Updated: 06/Jul/24 15:52
• Resolved: 06/Jul/24 15:52

Description

It would be helpful to provide a utility that could analyze keystores/truststores to verify compatibility and expected behavior with configured security settings such as two way SSL (right hostname, alias, etc). The idea is that as a diagnostic tool, we could provide users with some help to verify and troubleshoot any issues that may exist with certificates outside of more expensive change/restart loops with NiFi. As a follow-on, it would be helpful to get a listing of key properties about the configured keystore/truststore or files provided. An extension of this might additionally setup a client/server test with the utility between instances, again, to verify correct operation without doing so in NiFi itself as suggested by the parent ticket.

It would be nice to provide this as part of the NiFi release and accessible via nifi.sh. By extension, the functionality could also appear in the TLS toolkit.

Issue Links

• is a parent of: NIFI-7673 Toolkit in diagnostic mode should verify independent node
• is part of: NIFI-5458 Improve NiFi TLS and certificate management

Sub-Tasks

• Toolkit diagnostic for Cluster configuration: Resolved
• Toolkit diagnostic should verify user provisions and policies: Resolved