Hi Ryan, I want to try to understand your requirements a bit more in order to offer the best advice. Full disclosure, I have not performed this activity personally, so a lot of this will be speculation.
From your diagram and the fact that you specify incoming traffic is on port 80,
it appears that you do not want the communications between the browser and
NGINX to be encrypted/secured via TLS. I don’t necessarily understand this
(aside from intentionally not securing the data in transit, I am also unsure
how authentication will work if you are transmitting credentials in plaintext
between the browser and the proxy server), but this would not be the first
requirement I do not understand. Assuming that is correct though, I do not
believe you will need to extract the server key from the keystore to place in
NGINX. In this role, NGINX is acting as a client to the actual NiFi server, so
the private key should remain safely on the NiFi server only. I believe you
will need to extract the following pieces to reside on the NGINX server:
* client public certificate (this is to allow NGINX to present the certificate
to NiFi during TLS negotiation)
* client private key (this is to allow NGINX to prove identity during NiFi
client authentication)
To extract the client certificate and key from the keystore file that is
generated, I use a custom script, which I have provided below. It splits the
provided keystore into the private key and public certificate in the proper
format.
export_client ()
{
echo "Exporting client certificate and key from $1";
read -s -p "Keystore Password: " PASSWORD;
openssl pkcs12 -in "$1" -out client.der -nodes -password "pass:$PASSWORD";
openssl pkcs12 -in "$1" -nodes -nocerts -out client.key -password
"pass:$PASSWORD";
unset PASSWORD;
if [ "$(grep -e '-----BEGIN CERTIFICATE-----' client.der -F -c)" -gt 0 ];
then
perl -pe 'BEGIN{undef $/;} s|-----BEGIN PRIVATE KEY-----.*?-----END
PRIVATE KEY-----|Removed private key|gs' client.der > client.pem;
else
openssl x509 -inform der -in client.der -out client.pem;
fi;
ls -alGFh client.*
}
Andy LoPresto
[email protected] <mailto:[email protected]>
[email protected] <mailto:[email protected]>
PGP Fingerprint: 70EC B3E5 98A6 5A3F D3C4 BACE 3C6E F65B 2F7D EF69
> On Feb 7, 2018, at 1:55 PM, Ryan H <[email protected]
> <mailto:[email protected]>> wrote:
>
> Hi All,
>
> This may trivial, but I'm asking anyways for clarity. I am setting up a
> secure instance of NiFi behind NGINX for reverse proxy capabilities. I have a
> certain requirement that traffic coming in will hit NGINX as HTTP on port 80.
> NGINX will need to forward the request to the secure instance as HTTPS on
> port 8443.
>
> So: browser/API -> http -> NGINX -> https -> Secure NiFi
>
> Currently I am using the tls-toolkit in client/server mode for the secure
> instance to get its certs. I plan to have an OpenID provider configured for
> AuthN.
>
> From what I understand I will need to place the client key and certificate as
> well as server key and certificate on NGINX. This may be a bad assumption,
> but it's where I'm at, at this point.
>
> My question is: what would act as each of the key/certificates for both the
> client/server to be placed on NGINX based on what is generated from the
> tls-toolkit (which keys/certs would be extracted from each of the generated
> files/stores)? Is what I'm doing feasible (I'm assuming it is, but open to
> being wrong). I've tried a few different extractions from the keystore and
> truststore, but this is a weaker area of expertise for me and would rather be
> clear on what I'm doing.
>
> Any help is greatly appreciated.
>
> Cheers,
>
> Ryan H
signature.asc
Description: Message signed with OpenPGP using GPGMail
