Configure MiNiFi agent TLS
You can configure MiNiFi Agent TLS by updating the configuration files.
If you are configuring a MiNiFi Java agent, the configuration file is conf/bootstrap.conf. If you are configuring a MiNiFi C++ agent, the configuration file is conf/minifi.properties.
- Open your MiNiFi Agent configuration file in a text editor.
-
Edit the security properties for Java. For example:
# Security Properties # # These properties take precedence over any equivalent properties specified in config.yml file # nifi.minifi.security.keystore= nifi.minifi.security.keystoreType= nifi.minifi.security.keystorePasswd= nifi.minifi.security.keyPasswd= nifi.minifi.security.truststore= nifi.minifi.security.truststoreType= nifi.minifi.security.truststorePasswd= nifi.minifi.security.ssl.protocol= nifi.minifi.sensitive.props.key= nifi.minifi.sensitive.props.algorithm= nifi.minifi.sensitive.props.provider=
-
Edit the security properties for C++. For example:
# Security Properties # # enable tls # nifi.remote.input.secure=true # if you want to enable client certificate base authorization # nifi.security.need.ClientAuth=true # setup the client certificate and private key PEM files # nifi.security.client.certificate=./conf/client.pem nifi.security.client.private.key=./conf/client.pem # setup the client private key passphrase file # nifi.security.client.pass.phrase=./conf/password # setup the client CA certificate file # nifi.security.client.ca.certificate=./conf/nifi-cert.pem # if you do not want to enable client certificate base authorization # nifi.security.need.ClientAuth=false
You have the option of specifying an SSL Context Service definition for the RPGs instead of the preceding properties. This links to a corresponding SSL Context Service defined in the flow.
To do this, specify the SSL Context Service Property in your RPGs and link it to a defined controller service. For example:Remote Processing Groups: - name: NiFi Flow id: 2438e3c8-015a-1000-79ca-83af40ec1998 url: http://127.0.0.1:8080/nifi timeout: 30 secs yield period: 5 sec Input Ports: - id: 2438e3c8-015a-1000-79ca-83af40ec1999 name: fromnifi max concurrent tasks: 1 Properties: SSL Context Service: SSLServiceName Output Ports: - id: ac82e521-015c-1000-2b21-41279516e19a name: tominifi max concurrent tasks: 2 Properties: SSL Context Service: SSLServiceName Controller Services: - name: SSLServiceName id: 2438e3c8-015a-1000-79ca-83af40ec1974 class: SSLContextService Properties: Client Certificate: <client cert path> Private Key: < private key path > Passphrase: <passphrase path or passphrase> CA Certificate: <CA cert path>If you do not take this approach, the preceding properties will be used for TCP and secure HTTPS communications.
