Actually, each of your client's should generate their own key pair and
private keystore at the server/device that only *they* have access to
... and then you generate a cert request off of that private keystore
and provide the certificate signing request (CSR) to your Nifi Server's
certificate authority (... the CSR can be shared, just like your public
key/cert ... never share your private key ... that's the whole point of
Diffie-Hellman / asymmetric encryption algorithms ... keep the private
private/secret and the public public).
The CA then generates a Ca signed cert from your cert request. Again,
this signed cert can be publicly shared by the CA back to you without risk.
Then you import the CA signed cert back into your keystore, which will
overwrite your originally self-generated public key (... but will still
work with your original private key that you never share/shared).
You now have a key pair / keystore on your client for which only you
have ever had access to your private key ... but corresponding signed
public client cert can now be shared with anyone (... including your
NiFi server) in order to set up a secure two-way PKI authentication and
TLS channel.
But none of this has anything to do with NiFi ... this is all just
normal PKI / TLS / openssl / keytool stuff.
Pat
--
Patrick Timmins
https://www.linkedin.com/in/patrick-timmins/
On 5/12/2022 10:47 AM, Bryan Bende wrote:
Hello,
You have to use the toolkit again to create more client cert's and
specify the CN as the username you want. Also, you need to do this
from the same location you previously ran the toolkit so that reuses
the same self-signed CA, otherwise it will generate a whole new one
and your new client certs won't be trusted by NiFi.
-Bryan
On Thu, May 12, 2022 at 11:22 AM Jean-Sebastien Vachon
<[email protected]> wrote:
Hi again,
So I've been able to setup my Nifi server with client certificates for the
admin user, setup a few policies and create some group and users within Nifi
UI...
but how these new users will authenticate to Nifi? I guess I will have to
generate certificates for each of them but how do I create them?
Thanks
Jean-Sébastien Vachon
Co-Founder & Architect
Brizo Data, Inc.
www.brizodata.com
