You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "Jul Tomten (Jira)" <ji...@apache.org> on 2021/06/21 10:57:00 UTC
[jira] [Comment Edited] (NIFI-8713) ConsumeJMS and PublishJMS
SSL/TLS PKIX path building failed
[ https://issues.apache.org/jira/browse/NIFI-8713?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17364816#comment-17364816 ]
Jul Tomten edited comment on NIFI-8713 at 6/21/21, 10:56 AM:
-------------------------------------------------------------
!image-2021-06-17-12-07-32-920.png!
Got it working by setting extra properties. on the JMSConnectionFactoryProvider
property TrustStore
property TrustStorePassword
property TrustStoreType
Is it necessary to store the keystore password visible in plain text? Yes, without password it fails. Is it becasue of PKCS12 type keystore and JKS type should be used?
JMS SSL Context Service is maybe not the trust store but should contain client certificate when using mutual ssl/tls? in the documentation it says : *The SSL Context Service used to provide client certificate information for TLS/SSL connections.*
*If login with username and password the ssl context service isn't needed.*
*I think "JMS SSL Context Service" Property should be renamed to "JMS SSL Context Service client certificate"*
*Another property should be added "JMS SSL Context Service trust store" or TrustedCAs (the name SAP use in the java netweaver platform)*
was (Author: tomten1970):
!image-2021-06-17-12-07-32-920.png!
Got it working by setting extra properties. on the JMSConnectionFactoryProvider
property TrustStore
property TrustStorePassword
property TrustStoreType
Is it necessary to store the keystore password visible in plain text? Yes, without password it fails.
JMS SSL Context Service is maybe not the trust store but should contain client certificate when using mutual ssl/tls? in the documentation it says : *The SSL Context Service used to provide client certificate information for TLS/SSL connections.*
*If login with username and password the ssl context service isn't needed.*
*I think "JMS SSL Context Service" Property should be renamed to "JMS SSL Context Service client certificate"*
*Another property should be added "JMS SSL Context Service trust store" or TrustedCAs (the name SAP use in the java netweaver platform)*
> ConsumeJMS and PublishJMS SSL/TLS PKIX path building failed
> ------------------------------------------------------------
>
> Key: NIFI-8713
> URL: https://issues.apache.org/jira/browse/NIFI-8713
> Project: Apache NiFi
> Issue Type: Bug
> Components: Extensions
> Affects Versions: 1.13.2
> Environment: redhat
> java sap machine 1.11
> activemq-all-5.15.9.jar
> Reporter: Jul Tomten
> Priority: Major
> Labels: ConsumeJMS, PKIX, SSL, TLS, building, failed, path
> Attachments: image-2021-06-16-21-40-53-349.png, image-2021-06-17-12-07-32-920.png
>
>
> ConsumeJMS and PublichJMS SSL/TLS - error message PKIX path building failed
>
> In the current design the keystore password is stored in plain text. It should be stored in sensitive property. se comment below!
>
>
> !image-2021-06-16-21-40-53-349.png!
>
> getJMSQueue putJMSQueue works fine with the same jks file and SSL context service.
> invokeHTTP works fine with the same context service.
> I have a root ca that issues the server certificates without intermediate ca.
> In the trust store jks there is only one certificate so it's a very simple setup.
> Is there any extra requirements on the jks trsutstore when using ConsumeJMS or PublishJMS compared to getJMSQueue putJMSQueue ?
>
> The trust store type in the SSL context service seems to not matter if it is set to JKS or PKCS12 .
> ConsumeJMS or PublishJMS fails both with JKS and PKCS12
> getJMSQueue putJMSQueue works with JKS and PKCS12.
>
> java keytool lists my trust store as keystore type PKCS12 provider SUN.
> I have tested with a keystore of type JKS but it fails with the same error message.
>
> activemq-all-5.15.9.jar is used with ConsumeJMS or PublishJMS
> getJMSQueue putJMSQueue uses ActiveMQ driver shipped with NiFi
>
> The activemq-all-5.15.9.jar has been tested in sap po whrere it works fine.
>
> Tested using the JMS* properties on the processor instead of the connection factory service JMS context servive but still the same error message.
> I guess the ConsumeJMS or PublishJMS doesn't use the specified ssl context service but maybe fall back to using jdk cacerts file?
> Tested putting the root ca cert in cacerts file and in the file pointed to by nifi.security.truststore but it is still the same error message.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)