You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by bb...@apache.org on 2016/08/17 20:37:06 UTC
[2/2] nifi git commit: NIFI-2477 - Updating admin guide to account
for NIFI-2476 NIFI-2477 - Adding client dn to doc, examples
NIFI-2477 - Updating admin guide to account for NIFI-2476 NIFI-2477 - Adding client dn to doc, examples
This closes #875.
Signed-off-by: Bryan Bende <bb...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/nifi/repo
Commit: http://git-wip-us.apache.org/repos/asf/nifi/commit/5b58e5a2
Tree: http://git-wip-us.apache.org/repos/asf/nifi/tree/5b58e5a2
Diff: http://git-wip-us.apache.org/repos/asf/nifi/diff/5b58e5a2
Branch: refs/heads/master
Commit: 5b58e5a251e5165b0e09beb07594f23c3179c8dd
Parents: 9a16ca7
Author: Bryan Rosander <br...@gmail.com>
Authored: Tue Aug 16 14:48:35 2016 -0400
Committer: Bryan Bende <bb...@apache.org>
Committed: Wed Aug 17 16:36:40 2016 -0400
----------------------------------------------------------------------
.../src/main/asciidoc/administration-guide.adoc | 33 +++++++++++++++++---
1 file changed, 28 insertions(+), 5 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/nifi/blob/5b58e5a2/nifi-docs/src/main/asciidoc/administration-guide.adoc
----------------------------------------------------------------------
diff --git a/nifi-docs/src/main/asciidoc/administration-guide.adoc b/nifi-docs/src/main/asciidoc/administration-guide.adoc
index 830e003..b50f670 100644
--- a/nifi-docs/src/main/asciidoc/administration-guide.adoc
+++ b/nifi-docs/src/main/asciidoc/administration-guide.adoc
@@ -185,10 +185,33 @@ Standalone mode can be invoked by running \u201ctls-toolkit.sh standalone -h\u201d whi
The most common options to specify are:
-* -n (or --hostnames) a comma-separated list of hostnames that you\u2019d like to generate certificates for
+* -n (or --hostnames) a comma-separated list of hostnames that you\u2019d like to generate certificates for. It can be specified multiple times. Range and instance patterns are supported. (see below for details)
+* -C (or --clientCertDn) a DN that you'd like to generate a client certificate for. It can be specified multiple times.
* -f (or --nifiPropertiesFile) a base nifi.properties file that the tool will update for each host
* -o (or --outputDirectory) the directory to use for the resulting Certificate Authority files and NiFi configurations. A subdirectory will be made for each host.
-* -p (or --httpsPort) the https port in nifi.properties and enable secure site-to-site. This is optional and not required if you\u2019ve provided a template nifi.properties.
+
+Hostname Patterns:
+
+* Square brackets can be used in order to easily specify a range of hostnames. Example: [01-20]
+* Parentheses can be used in order to specify that more than one NiFi instance will run on the given host(s). Example: (5)
+
+Examples:
+
+Create 4 sets of keystore, truststore, nifi.properties for localhost along with a client certificate with the given DN:
+----
+bin/tls-toolkit.sh standalone -n 'localhost(4)' -C 'CN=username,OU=NIFI'
+----
+
+Create keystore, truststore, nifi.properties for 10 nifi hostnames in each of 4 subdomains:
+----
+bin/tls-toolkit.sh standalone -n 'nifi[01-10].subdomain[1-4].domain'
+----
+
+Create 2 sets of keystore, truststore, nifi.properties for 10 nifi hostnames in each of 4 subdomains along with a client certificate with the given DN:
+----
+bin/tls-toolkit.sh standalone -n 'nifi[01-10].subdomain[1-4].domain(2)' -C 'CN=username,OU=NIFI'
+----
+
Client/Server
^^^^^^^^^^^^^
@@ -215,12 +238,12 @@ The most common options to specify are:
* -f (or --configJson) the json config file
* -c (or --certificateAuthorityHostname) the hostname of the CA
* -D (or --DN) the DN for the CSR (and Certificate)
-* -t (or --token) the token used to prevent man in the middle attacks (this should be a long, random value and needs to be known when invoking the client)
-* -T (or --keyStoreType) the type of keystore to create (specify jks for NiFi nodes, leave default to create client cert)
+* -t (or --token) the token used to prevent man in the middle attacks (this should be a long, random value and needs to be the same one used to start the CA server)
+* -T (or --keyStoreType) the type of keystore to create (leave default for NiFi nodes, specify PKCS12 to create client cert)
After running the client you will have the CA\u2019s certificate, a keystore, a truststore, and a config.json with information about them as well as their passwords.
-If you leave -T (or --keyStoreType) as its default value, PKCS12 will be used in order to make it easy to import into a browser for client certificates.
+For a client certificate that can be easily imported into the browser, specify: -T PKCS12
User Authentication
-------------------