[NIFI-5370] Cluster request replication failing with wildcard certs

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.7.0
• Fix Version/s: 1.8.0, 1.7.1
• Component/s: Core Framework
• Labels: certificate cluster security tls wildcard
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 03/Jul/18 17:03
• Updated: 24/Oct/18 14:50
• Resolved: 10/Jul/18 12:47

Description

From the users mailing list:

Team,

NiFi secured cluster throws below error with wildcarded self-signed standalone certificate. Just a brief background, we are deploying nifi in Kubernetes where we have to use wildcarded certificates. Till nifi 1.6.0, it was working fine.
Also I tried bringing up NiFi in linux VM in secured cluster mode with wildcarded certs, I am getting same error.

Toolkit command to generate certs:
bin/tls-toolkit.sh standalone -n '*.mynifi-nifi-headless.default.svc.cluster.local’ -C 'CN=admin, OU=NIFI' -o <targetfolder>

Logs:
2018-07-02 12:40:32,369 WARN [Replicate Request Thread-1] o.a.n.c.c.h.r.ThreadPoolRequestReplicator Failed to replicate request GET /nifi-api/flow/current-user to mynifi-nifi-1.mynifi-nifi-headless.default.svc.cluster.local:8443 due to javax.net.ssl.SSLPeerUnverifiedException: Hostname mynifi-nifi-1.mynifi-nifi-headless.default.svc.cluster.local not verified:
certificate: sha256/########################################
DN: CN=*.mynifi-nifi-headless.default.svc.cluster.local, OU=NIFI
subjectAltNames: [*.mynifi-nifi-headless.default.svc.cluster.local]
2018-07-02 12:40:32,370 WARN [Replicate Request Thread-1] o.a.n.c.c.h.r.ThreadPoolRequestReplicator
javax.net.ssl.SSLPeerUnverifiedException: Hostname mynifi-nifi-1.mynifi-nifi-headless.default.svc.cluster.local not verified:
certificate: sha256/########################################
DN: CN=*.mynifi-nifi-headless.default.svc.cluster.local, OU=NIFI
subjectAltNames: [*.mynifi-nifi-headless.default.svc.cluster.local]
at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:316)

Please help me in resolving this.

Note: Same certificates is working for single mode setup.

Issue Links

• links to: GitHub Pull Request #2869