[NIFI-5462] Refactor TLS Toolkit

• Type: Improvement
• Status: In Progress
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.7.1
• Component/s: Security, Tools and Build
• Labels: certificate nifi-registry pki refactor registry security tls-toolkit
• Epic Link: NiFi security configuration requires substantial knowledge and effort to deploy
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 26/Jul/18 02:00
• Updated: 07/May/19 20:06

Description

The TLS Toolkit was originally designed with limited scope and has since grown organically to meet additional requirements. Because of this, its components can be disjoint, there is unnecessary code and communication interfaces, and it can be difficult to extend.

A complete refactor should be performed to remove superfluous code, make it easier to extend, separate concerns (command-line interaction, certificate generation and signing, and component communication [client/server, internal/external]).

Along with this refactor, it should be extended to handle additional components which require certificate generation, signing, and trust allocation, such as the Apache NiFi Registry.

Issue Links

• is related to: NIFI-6178 Certificates generated for "localhost" need to have IP as a SAN in Java 11
• is related to: NIFI-5363 Enhance NiFi Toolkit to handle NiFi Registry
• relates to: NIFI-6273 Improve log output for TLS Toolkit tasks