TLS 1.3 enforcement for NiFi and NiFi Registry
Learn how to enforce TLS 1.3 and configure the required cipher suites for NiFi and NiFi Registry.
Starting with Cloudera Flow Management 4.12.0.10000 (Service Pack 1), NiFi and NiFi Registry accept only TLS 1.3 connections when TLS 1.3 is configured through Cloudera Manager. The CSD configuration template automatically populates the relevant security properties with the supported TLS 1.3 cipher suites.
When TLS 1.3 is enabled, the CSD configuration template automatically populates the following properties with the appropriate TLS 1.3 cipher suites:
| Property | Component |
|---|---|
| nifi.web.https.ciphersuites.include | NiFi |
| nifi.registry.web.https.ciphersuites.include | NiFi Registry |
If you previously configured a custom value for either of these properties, your existing configuration is preserved and is not overwritten.
When TLS 1.3-only communication is enabled, connections that use TLS 1.2 or earlier are rejected at the following endpoints:
- NiFi web UI
- NiFi REST API endpoints
- NiFi site-to-site ports
- NiFi Registry web UI
- NiFi Registry REST API endpoints
Upgrade considerations
For existing clusters managed by Cloudera Manager and configured to use TLS 1.3, a Cloudera Manager upgrade handler automatically applies the required cipher suite configuration during the upgrade. You do not need to update the NiFi or NiFi Registry properties manually.
