You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "fgerlits (via GitHub)" <gi...@apache.org> on 2023/07/28 15:51:29 UTC
[GitHub] [nifi-minifi-cpp] fgerlits opened a new pull request, #1620: MINIFICPP-2170 Fix system certificate store usage in SSLContextService on Linux
fgerlits opened a new pull request, #1620:
URL: https://github.com/apache/nifi-minifi-cpp/pull/1620
https://issues.apache.org/jira/browse/MINIFICPP-2170
Use `utils::getDefaultCAFile()` in the `SSLContextService` to find the system CA certificate store file, as the compiled-in default value is usually wrong. If the system CA certificate store file is still not found, you can set the `SSL_CERT_DIR` or `SSL_CERT_FILE` environment variables to tell OpenSSL where the certificates are.
Also: fix the incorrect handling of `InvokeHTTP::DisablePeerVerification`.
---
Thank you for submitting a contribution to Apache NiFi - MiNiFi C++.
In order to streamline the review of the contribution we ask you
to ensure the following steps have been taken:
### For all changes:
- [x] Is there a JIRA ticket associated with this PR? Is it referenced
in the commit message?
- [x] Does your PR title start with MINIFICPP-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
- [x] Has your PR been rebased against the latest commit within the target branch (typically main)?
- [ ] Is your initial contribution a single, squashed commit?
### For code changes:
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the LICENSE file?
- [ ] If applicable, have you updated the NOTICE file?
### For documentation related changes:
- [ ] Have you ensured that format looks appropriate for the output in which it is rendered?
### Note:
Please ensure that once the PR is submitted, you check GitHub Actions CI results for build issues and submit an update to your PR as soon as possible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi-minifi-cpp] fgerlits commented on pull request #1620: MINIFICPP-2170 Fix system certificate store usage in SSLContextService on Linux
Posted by "fgerlits (via GitHub)" <gi...@apache.org>.
fgerlits commented on PR #1620:
URL: https://github.com/apache/nifi-minifi-cpp/pull/1620#issuecomment-1665754649
> Could we document the `SSL_CERT_DIR` and `SSL_CERT_FILE` environment variable options for setting the certificate somewhere? Maybe write a test using those variables as well?
I was planning to do that, but it would take quite a bit of additional code to create automatic tests for this, as it requires that none of the paths listed in `utils::getDefaultCAPath()` exists (so we'd have to remove it), and also we'd need to create a mechanism for setting environment variables in the MiNiFi container.
I don't think we want to encourage people to use the `SSL_CERT_DIR` and `SSL_CERT_FILE` environment variables; setting the `CA Certificate` property in `SSLContextService` or the `SSL Certificate Authority` property in `ListenHTTP` is a better option.
I have tested these manually because in case there is a production issue we need a quick temporary solution for, it's good to know we have this option.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi-minifi-cpp] lordgamez closed pull request #1620: MINIFICPP-2170 Fix system certificate store usage in SSLContextService on Linux
Posted by "lordgamez (via GitHub)" <gi...@apache.org>.
lordgamez closed pull request #1620: MINIFICPP-2170 Fix system certificate store usage in SSLContextService on Linux
URL: https://github.com/apache/nifi-minifi-cpp/pull/1620
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi-minifi-cpp] lordgamez commented on pull request #1620: MINIFICPP-2170 Fix system certificate store usage in SSLContextService on Linux
Posted by "lordgamez (via GitHub)" <gi...@apache.org>.
lordgamez commented on PR #1620:
URL: https://github.com/apache/nifi-minifi-cpp/pull/1620#issuecomment-1665588940
Could we document the `SSL_CERT_DIR` and `SSL_CERT_FILE` environment variable options for setting the certificate somewhere? Maybe write a test using those variables as well?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org