Chris Sampson created NIFI-14063:
------------------------------------
Summary: NiFi Registry silently fails to start if the JVM does not
trust the server certificate
Key: NIFI-14063
URL: https://issues.apache.org/jira/browse/NIFI-14063
Project: Apache NiFi
Issue Type: Bug
Affects Versions: 2.0.0
Reporter: Chris Sampson
Attempting to run a NiFi Registry instance as a StatefulSet in Kubernetes, with
certificates created via Cert Manager using a custom CA (i.e. not from a CA
that's part of the standard JVM {{cacerts}} file) results in Registry
attempting to start, but ultimately failing with no errors logged other than
the ["NiFi Registry never started. Will not restart NiFi Registry
"](https://github.com/apache/nifi/blob/main/nifi-registry/nifi-registry-core/nifi-registry-bootstrap/src/main/java/org/apache/nifi/registry/bootstrap/RunNiFiRegistry.java#L1012)
bootstrap message.
This happens when using default Registry settings, except for:
* KEYSTORE_PATH
* KEYSTORE_TYPE
* KEYSTORE_PASSWORD
* TRUSTSTORE_PATH
* TRUSTSTORE_TYPE
* TRUSTSTORE_PASSWORD
which are used by the NiFi Registry's Docker Image
[secure.sh](https://github.com/apache/nifi/blob/main/nifi-registry/nifi-registry-core/nifi-registry-docker/dockerhub/sh/secure.sh#L41)
script to set the appropriate {{nifi-registry.properties}}
To get Registry running, it was necessary to:
* copy the default {{${JAVA_HOME}/lib/security/cacerts}} file
* use {{keytool} to import the custom CA certificate(s) into the copied
{{cacerts}} keystore
* update the Registry {{conf/bootstrap.conf}} to use the updated {{cacerts}},
e.g.
{{java.arg.truststore=-Djavax.net.ssl.trustStore=/opt/nifi-registry/nifi-registry-current/conf/cacerts_updated.jks}}
Inspiration for this was taken from a NiFiKop issue about similar behaviour in
NiFi - https://github.com/konpyutaika/nifikop/issues/447 (although for NiFi,
meaningful errors are logged during startup that indicate there's a certificate
problem, so the operator is able to determine where to focus on fixing the
problem).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
