andrewmlim commented on a change in pull request #3242: NIFI-5926 Added certificate commands to toolkit guide. URL: https://github.com/apache/nifi/pull/3242#discussion_r245332622
########## File path: nifi-docs/src/main/asciidoc/toolkit-guide.adoc ########## @@ -1126,6 +1127,13 @@ coefficient: . To convert from PKCS #8 PEM format to PKCS #1 PEM format: * If the private key is provided in PKCS #8 format (the file begins with `-----BEGIN PRIVATE KEY-----` rather than `-----BEGIN RSA PRIVATE KEY-----`), the following command will convert it to PKCS #1 format, move the original to `nifi-key-pkcs8.key`, and rename the PKCS #1 version as `nifi-key.key`: ** `openssl rsa -in nifi-key.key -out nifi-key-pkcs1.key && mv nifi-key.key nifi-key-pkcs8.key && mv nifi-key-pkcs1.key nifi-key.key` +. To combine a private key in PEM format (`private.key`) and public certificate in PEM format (`certificate.pem`) into PKCS12 keystore: + * The following command will create the PKCS12 keystore (`keystore.p12`) from the two independent files. A Java keystore (JKS) cannot be formed directly from the PEM files: + ** `openssl pkcs12 -export -out keystore.p12 -inkey private.key -in certificate.pem` +. To convert a PKCS12 keystore (`keystore.p12`) to JKS keystore (`keystore.jks`): + * The following command will create the JKS keystore (`keystore.jks`). The `-destalias` flag is optional, as NiFi does not currently read from a specific alias in the keystore. The user will be prompted for a keystore password, which must be set and have minimum 8 characters, and a key password, which can be the same as the keystore password or different: + ** `keytool -importkeystore -srckeystore keystore.p12 -srcstoretype pkcs12 -destkeystore keystore.jks + -deststoretype jks -destalias nifi-key` [[tls_external-signed_ca]] ==== Signing with Externally-signed CA Certificates Review comment: Pending what is done with the Additional Certificate Commands section, this section might also need to be edited to be on the same level. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
