[NIFI-5622] Test certificates require SAN values

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.7.1
• Fix Version/s: 1.8.0
• Component/s: Core Framework, Tools and Build
• Labels: certificate security test
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 21/Sep/18 17:07
• Updated: 04/Oct/18 14:37
• Resolved: 04/Oct/18 13:51

Description

During the update of OkHttp from 3.6.0 to 3.11.0 in NIFI-4806, it was discovered that SubjectAlternativeName checking is now required, as described in RFC 6125. The test resource keystore and truststores need to be updates to provide SAN values.

Issue Links

• blocks: NIFI-4806 Upgrade to Tika/Tika-Parsers 1.19 to resolve TIKA-2535 and CVEs reported against all releases prior to 1.19
• incorporates: NIFI-5623 Update all usage of Okhttp to latest library
• is a clone of: NIFI-1354 InvokeHTTP test certificates have expired
• Is contained by: NIFI-5458 Improve NiFi TLS and certificate management
• is part of: NIFI-5623 Update all usage of Okhttp to latest library
• is related to: NIFI-1353 Update version of OkHttp
• relates to: NIFI-1355 Provide dynamic code-generated certificates for HTTP tests to avoid expiry
• links to: GitHub Pull Request #3018