Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-11536

nifi.security.autoreload.enabled is broken since v1.17.0

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 1.17.0, 1.18.0, 1.19.0, 1.20.0
    • 2.0.0-M1, 1.23.0
    • Security
    • standalone

    Description

      NiFi standalone with nifi.security.autoreload.enabled=true does not reload TLS keystore after upgrade from 1.16.3 to 1.17.0 onward.

      Steps to reproduce:

      1/ Generate truststore and 2 keystores for nifi standalone using nifi toolkit. Two keystores should be generated at least 5 minutes apart from each other since we use the certificate start time to verify if the new cert is loaded later

      e.g.

      bin/tls-toolkit.sh standalone -n nifi.tmanet.com \
      --subjectAlternativeNames nifi.tmanet.com -P TErbdTQutLvFVd3kunMcCL5/OG1K+t2l/Q1vSiJbJp8 \
      -S JaTxUVN+HK8+LyPCs9ruJXCiYq/zr1bYUxJBjEGnjpw

      2/ Configure nifi standalone with generated truststore and one of the keystore then start nifi (ensure nifi.security.autoreload.enabled=true in your nifi.properties)

      3/ Check the certificate start date return when calling nifi url e.g. nifi.tmanet.com:9443

      curl -kv https://nifi.tmanet.com:9443 2>&1 | /bin/grep start

      4/ Replace keystore.jks by another keystore generated above and wait for nifi.security.autoreload.interval (default 10s) and recheck the nifi certificate by 

      curl -kv https://nifi.tmanet.com:9443 2>&1 | /bin/grep start

      Attachments

        Issue Links

          Activity

            People

              emilio.setiadarma Emilio Setiadarma
              nathluu Tan Luu
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 1.5h
                  1.5h