You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by GitBox <gi...@apache.org> on 2020/08/31 21:39:41 UTC
[GitHub] [nifi] thenatog opened a new pull request #4503: NIFI-7767 - Fixed issue with tls-toolkit not adding SANs to generated…
thenatog opened a new pull request #4503:
URL: https://github.com/apache/nifi/pull/4503
… certificates. Added tests.
NIFI-7767 - Fixed checkstyle.
NIFI-7767 - Fixed up TlsCertificateAuthorityTest to include SAN in tests.
Thank you for submitting a contribution to Apache NiFi.
Please provide a short description of the PR here:
#### Description of PR
_Enables X functionality; fixes bug NIFI-YYYY._
In order to streamline the review of the contribution we ask you
to ensure the following steps have been taken:
### For all changes:
- [x] Is there a JIRA ticket associated with this PR? Is it referenced
in the commit message?
- [x] Does your PR title start with **NIFI-XXXX** where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
- [x] Has your PR been rebased against the latest commit within the target branch (typically `main`)?
- [x] Is your initial contribution a single, squashed commit? _Additional commits in response to PR reviewer feedback should be made on this branch and pushed to allow change tracking. Do not `squash` or use `--force` when pushing to allow for clean monitoring of changes._
### For code changes:
- [x] Have you ensured that the full suite of tests is executed via `mvn -Pcontrib-check clean install` at the root `nifi` folder?
- [x] Have you written or updated unit tests to verify your changes?
- [x] Have you verified that the full build is successful on JDK 8?
- [x] Have you verified that the full build is successful on JDK 11?
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE` file, including the main `LICENSE` file under `nifi-assembly`?
- [ ] If applicable, have you updated the `NOTICE` file, including the main `NOTICE` file found under `nifi-assembly`?
- [ ] If adding new Properties, have you added `.displayName` in addition to .name (programmatic access) for each of the new properties?
### For documentation related changes:
- [ ] Have you ensured that format looks appropriate for the output in which it is rendered?
### Note:
Please ensure that once the PR is submitted, you check GitHub Actions CI for build issues and submit an update to your PR as soon as possible.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] alopresto commented on pull request #4503: NIFI-7767 - Fixed issue with tls-toolkit not adding SANs to generated…
Posted by GitBox <gi...@apache.org>.
alopresto commented on pull request #4503:
URL: https://github.com/apache/nifi/pull/4503#issuecomment-684953511
Reviewing...
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] alopresto commented on pull request #4503: NIFI-7767 - Fixed issue with tls-toolkit not adding SANs to generated…
Posted by GitBox <gi...@apache.org>.
alopresto commented on pull request #4503:
URL: https://github.com/apache/nifi/pull/4503#issuecomment-685186622
Verified the full build and the new unit tests ran successfully. Used the tool in client/server mode to generate two new keystores. The first was invoked with only a DN and had the CN successfully populated as a SAN. The second was invoked with explicit SAN entries and had all provided hosts listed as SANs. +1, merging.
```
..13.0-SNAPSHOT pr4503 ● ./bin/tls-toolkit.sh client -D CN=node1.nifi -p 9999 -t tokentokent
okent
2020/09/01 16:18:42 INFO [main] org.apache.nifi.toolkit.tls.service.client.TlsCertificateAuthorityClient: Requesting new certificate from localhost:9999
2020/09/01 16:18:43 INFO [main] org.apache.nifi.toolkit.tls.service.client.TlsCertificateSigningRequestPerformer: Requesting certificate with dn CN=node1.nifi from localhost:9999
2020/09/01 16:18:43 INFO [main] org.apache.nifi.toolkit.tls.service.client.TlsCertificateSigningRequestPerformer: Got certificate with dn CN=node1.nifi
..13.0-SNAPSHOT pr4503 ● keytool -list -v -keystore keystore.jks 16:18:47
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: nifi-key
Creation date: Sep 1, 2020
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=node1.nifi
Issuer: CN=localhost, OU=NIFI
Serial number: 1744bf7293f00000000
Valid from: Tue Sep 01 16:18:43 PDT 2020 until: Mon Dec 05 15:18:43 PST 2022
Certificate fingerprints:
SHA1: FF:69:2D:99:90:C2:7C:90:7F:07:51:84:53:A4:DD:12:8A:2C:76:D0
SHA256: 41:F0:71:40:B7:9E:D8:4E:BC:71:78:9B:2F:1C:F7:8B:3D:34:93:74:93:98:6E:A8:E0:48:E8:6A:D2:52:5C:DB
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
Extensions:
...
#5: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: node1.nifi
]
...
..13.0-SNAPSHOT pr4503 ● nocorrect mv config.json node1.json 16:20:44
..13.0-SNAPSHOT pr4503 ● nocorrect mv keystore.jks node1.jks 16:23:00
..13.0-SNAPSHOT pr4503 ● nocorrect mv truststore.jks node1_ts.jks 16:23:19
..13.0-SNAPSHOT pr4503 ● ./bin/tls-toolkit.sh client -D CN=node2.nifi -p 9999 -t tokentokentokent --subjectAlternativeNames san.nifi,san2.nifi,san3.nifi
2020/09/01 16:23:35 INFO [main] org.apache.nifi.toolkit.tls.service.client.TlsCertificateAuthorityClient: Requesting new certificate from localhost:9999
2020/09/01 16:23:36 INFO [main] org.apache.nifi.toolkit.tls.service.client.TlsCertificateSigningRequestPerformer: Requesting certificate with dn CN=node2.nifi from localhost:9999
2020/09/01 16:23:36 INFO [main] org.apache.nifi.toolkit.tls.service.client.TlsCertificateSigningRequestPerformer: Got certificate with dn CN=node2.nifi
..13.0-SNAPSHOT pr4503 ● keytool -list -v -keystore keystore.jks 16:24:01
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: nifi-key
Creation date: Sep 1, 2020
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=node2.nifi
Issuer: CN=localhost, OU=NIFI
Serial number: 1744bfba2b100000000
Valid from: Tue Sep 01 16:23:36 PDT 2020 until: Mon Dec 05 15:23:36 PST 2022
Certificate fingerprints:
SHA1: 27:C7:3D:11:DD:D1:F2:24:2C:FC:2A:59:B4:E5:89:29:2B:79:D1:80
SHA256: A3:FE:70:BB:8B:34:50:91:21:C3:FA:3B:91:07:22:74:E4:5B:AD:FA:F5:CE:A0:2B:82:A5:93:80:CC:E9:81:52
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
Extensions:
...
#5: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: node2.nifi
DNSName: san.nifi
DNSName: san2.nifi
DNSName: san3.nifi
]
...
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] alopresto commented on pull request #4503: NIFI-7767 - Fixed issue with tls-toolkit not adding SANs to generated…
Posted by GitBox <gi...@apache.org>.
alopresto commented on pull request #4503:
URL: https://github.com/apache/nifi/pull/4503#issuecomment-685188638
Forgot to tag the commit message with the PR #. Code was merged in 1e6619b91f2d9a7af2d7195464d4a0f5b595b93d. Closing PR manually.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] alopresto closed pull request #4503: NIFI-7767 - Fixed issue with tls-toolkit not adding SANs to generated…
Posted by GitBox <gi...@apache.org>.
alopresto closed pull request #4503:
URL: https://github.com/apache/nifi/pull/4503
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org