[jira] [Commented] (NIFI-1355) Provide dynamic code-generated certificates for HTTP tests to avoid expiry

["Andy LoPresto (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/NIFI-1355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15086147#comment-15086147 ] 

Andy LoPresto commented on NIFI-1355:
-------------------------------------

As noted by [~aldrin] there are many places throughout the test code that use certificates. The dynamic certificate generation code should be available to each of these uses, or ideally the keystore and truststore unique to each scenario should be combined into a single test keystore and test truststore unless there are cross-contamination issues. 

> Provide dynamic code-generated certificates for HTTP tests to avoid expiry
> --------------------------------------------------------------------------
>
>                 Key: NIFI-1355
>                 URL: https://issues.apache.org/jira/browse/NIFI-1355
>             Project: Apache NiFi
>          Issue Type: Improvement
>          Components: Core Framework
>    Affects Versions: 0.4.0, 0.4.1
>            Reporter: Andy LoPresto
>            Assignee: Andy LoPresto
>              Labels: certificate, security, test
>             Fix For: 0.6.0
>
>
> As documented, the test certificates/keys used in the TestInvokeHttp and TestInvokeHttpSSL tests expired in 2014. With the constant removal of non-certificate based cipher suites from client libraries, the lack of valid certificates meant that the Jetty server could not offer any compatible cipher suites, and the tests failed. I manually generated and loaded new certificates but they expire after 1 year. Adding code to dynamically generate and load these certificates into the keystore and truststore would remove this inconsistent blocker. 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)