[NIFI-5586] Add capability to generate ECDSA keys to TLS Toolkit

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Affects Version/s: 1.7.1
• Component/s: Tools and Build
• Labels: cryptography ecc ecdsa security tls tls-toolkit
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 11/Sep/18 02:17
• Updated: 03/Nov/23 20:49
• Resolved: 03/Nov/23 20:49

Description

The TLS Toolkit should be able to generate ECDSA keys to enable NiFi to support ECDSA cipher suites.

Currently, ECDSA keys can be manually generated using external tools and loaded into a keystore and truststore that are compatible with NiFi.

keytool -genkeypair -alias ec -keyalg EC -keysize 256 -sigalg SHA256withECDSA -validity 365 -storetype JKS -keystore ec-keystore.jks -storepass passwordpassword
keytool -export -alias ec -keystore ec-keystore.jks -file ec-public.pem
keytool -import -alias ec -file ec-public.pem -keystore ec-truststore.jks -storepass passwordpassword

Issue Links

• depends upon: NIFI-1995 Support keystores with multiple certificates by exposing alias selection in configuration
• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is related to: NIFI-12200 Remove nifi-toolkit-tls module