[NIFI-5398] Identify cluster communication endpoints via combination of hostname and certificate rather than just certificate DN

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.7.0
• Component/s: Core Framework
• Labels: TLS certificate client-auth cluster security
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 10/Jul/18 00:36
• Updated: 15/Feb/19 00:16

Description

Currently, NiFi cluster communications have a number of instances where the remote endpoint is identified by extracting the distinguished name (DN) from the presented peer certificate (see SocketProtocolListener).

Users who try to provide the same wildcard certificate to all cluster nodes will encounter issues with this approach. These instances should be investigated and changed to use a combination of the socket connections' remote hostname and the certificate to validate the unique hostname making the request.

Issue Links

• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is depended upon by: NIFI-5443 Improve cluster configuration for dynamic scaling