This is an automated email from the ASF dual-hosted git repository. joewitt pushed a commit to branch support/nifi-1.11.x in repository https://gitbox.apache.org/repos/asf/nifi.git
commit 85cc5689e636bd3e727872e8feb2834cd7ffeb7a Author: Andrew Lim <[email protected]> AuthorDate: Fri Jan 31 13:18:05 2020 -0500 NIFI-7053 Update Toolkit Guide with macOS 10.15 requirements for trus… (#4018) * NIFI-7053 Update Toolkit Guide with macOS 10.15 requirements for trusted certificates * Simplified note about trusted certs in macOS 10.15 Signed-off-by: Andy LoPresto <[email protected]> --- nifi-docs/src/main/asciidoc/toolkit-guide.adoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nifi-docs/src/main/asciidoc/toolkit-guide.adoc b/nifi-docs/src/main/asciidoc/toolkit-guide.adoc index 44e67e2..baaf555 100644 --- a/nifi-docs/src/main/asciidoc/toolkit-guide.adoc +++ b/nifi-docs/src/main/asciidoc/toolkit-guide.adoc @@ -721,6 +721,8 @@ Example usage to send a FlowFile with the contents of "hey nifi" to a local unse == TLS Toolkit In order to facilitate the secure setup of NiFi, you can use the `tls-toolkit` command line utility to automatically generate the required keystores, truststore, and relevant configuration files. This is especially useful for securing multiple NiFi nodes, which can be a tedious and error-prone process. +NOTE: Please note that there are new requirements for trusted certificates in macOS 10.15. Details can be found link:https://support.apple.com/en-us/HT210176[here^], but of particular importance is that all TLS server certificates issued after July 1, 2019 must have a validity period of 825 days or less. + [[wildcard_certificates]] === Wildcard Certificates Wildcard certificates (i.e. two nodes `node1.nifi.apache.org` and `node2.nifi.apache.org` being assigned the same certificate with a CN or SAN entry of `+*.nifi.apache.org+`) are *not officially supported* and *not recommended*. There are numerous disadvantages to using wildcard certificates, and a cluster working with wildcard certificates has occurred in previous versions out of lucky accidents, not intentional support. Wildcard SAN entries are acceptable *if* each cert maintains an ad [...]
