[NIFI-5476] Enable TLS Toolkit (standalone) to sign certificates with external CA certificate

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.7.1
• Fix Version/s: 1.8.0
• Component/s: Security, Tools and Build
• Labels: certificate pem pkcs1 pkcs8 pki security tls tls-toolkit
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 01/Aug/18 01:55
• Updated: 03/Jan/19 21:48
• Resolved: 07/Aug/18 19:10

Description

The TLS Toolkit can sign certificates using a public certificate and private key generated and signed elsewhere by injecting them into the nifi-cert.pem and nifi-key.key files as long as they are in the proper format and self-signed. The toolkit should be enhanced to handle PKCS #8 formatted private keys (in addition to the PKCS #1 formatted keys it handles now) and to allow for non self-signed certificates.

To verify this, use certificates generated by TinyCert.

Issue Links

• contains: NIFI-5459 Integrate TLS Toolkit with external CA / certificate providers
• contains: NIFI-5473 Add documentation for using intermediate CA with TLS toolkit
• is cloned by: NIFI-5485 Enable TLS Toolkit (client/server) to sign certificates with external CA certificate
• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• relates to: NIFI-5473 Add documentation for using intermediate CA with TLS toolkit
• links to: GitHub Pull Request #2935