[NIFI-5459] Integrate TLS Toolkit with external CA / certificate providers

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Affects Version/s: 1.7.1
• Component/s: Extensions, Security, Tools and Build
• Labels: certificate security tls tls-toolkit
• Epic Link: NiFi security configuration requires substantial knowledge and effort to deploy
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 25/Jul/18 22:51
• Updated: 03/Nov/23 20:49
• Resolved: 03/Nov/23 20:49

Description

The TLS toolkit was designed to be a sandbox-level assistant for deployments which did not have access to a security team / dedicated certificate provider to replace manual generation of certificates with complicated openssl and keytool commands. It has grown to be depended on by many users, as well as Apache Ambari deployments.

Because of these uses, it should be made more robust, including integration with external certificate providers. Multiple commercial certificate providers have APIs for automating the submission of CSRs and requesting issuance of signed certificates. In the standalone or client/server model, the toolkit should be able to define an external certificate provider, and if the proper "definition" (API mapping) is available, use provided credentials to request and receive a signed certificate. There should be an intermediate mapping between a "toolkit-standard communication method" and the communication with the external provider, so that the toolkit requestor (standalone/client) does not need to change; either the server maps the standard request to a specific provider, or the standalone component uses the pluggable mapping to do the same.

Only two definitions should be required to mark this ticket as complete:

• the internal NiFi provider (map toolkit commands to internal openssl generation commands)
• an external provider (suggest letsencrypt.org as it is free, non-profit, and domain validation (DV) is automated)

Additional definitions can be provided as follow-on tickets independent of this ticket. If internal organization/enterprise certificate providers are needed, they can follow the well-defined extension point which should result from this effort.

Issue Links

• Is contained by: NIFI-5476 Enable TLS Toolkit (standalone) to sign certificates with external CA certificate
• Is contained by: NIFI-5485 Enable TLS Toolkit (client/server) to sign certificates with external CA certificate
• is related to: NIFI-12200 Remove nifi-toolkit-tls module