Nifi upstream connect error with https

Hi Nho Luong

You can set up the gateway to handle HTTPS for external clients and have NiFi listen on HTTP internally.

We request you to please check below details:

• Configure NIFI for HTTP and Make sure it should listen Port 8080 for HTTP traffic instead of HTTPS.
• Enable HTTPS on Application Gateway’s frontend using a trusted SSL certificate.
• Configure the gateway to listen on port 443 with its own SSL certificate, terminate the SSL connection, and forward traffic to NiFi's exposed port 8080 via HTTP. Ensure network settings allow this connection without firewall blocks.
• Certificates required to allow backend servers - Azure Application Gateway | Microsoft Learn
• After making changes we request to restart Nifi and check.

For more information, please refer this document:

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview

Let me know if the above steps helps and if you have any further questions feel free to reach out to us.

Hi Nho Luong,

are you must use backend HTTPS (8443) or without backend? Depends of u answer I would try to answer of u questions

rgds,

Alex

Yes, i have try backend HTTPS (8443) and try
Listener: HTTPS on port 443

1. Backend HTTP Settings:

• Protocol: HTTP
• Port: 8080
  • Pick host name from backend target ✅
  App Gateway terminates HTTPS → forwards via HTTP to NiFi on port 8080 But the same error

Hi again,

So i suppouse the error persists because even though you've configured SSL termination at the Application Gateway, NiFi itself may still be enforcing HTTPS connections or rejecting the plain HTTP traffic from the gateway. When using Standard_v2 with backend HTTP, you must ensure NiFi is properly configured to accept HTTP-only connections. verify your nifi.properties file has HTTPS completely disabled by checking that nifi.web.https.host is empty and HTTP is enabled on port 8080. Also confirm that any reverse proxy headers or security filters in NiFi aren't enforcing HTTPS. The Application Gateway's health probes might be failing if they're not reaching an open HTTP endpoint - try configuring them to target /nifi-api/flow/status with HTTP. Additionally, check your Azure network security groups to ensure traffic from the Application Gateway's private IP is allowed on port 8080. If NiFi's UI or API still redirects to HTTPS despite your configuration, there may be lingering security settings in authorizers.xml or login-identity-providers.xml enforcing secure connections. For troubleshooting, examine NiFi's logs for connection attempts from the gateway's IP to identify if requests are being rejected. Temporarily disabling all security in NiFi (setting nifi.security.keystorePasswd and related properties to empty values) can help isolate whether the issue is certificate-related. Remember that Standard_v2 cannot properly validate backend certificates, so forcing HTTPS between gateway and NiFi will likely fail - stick with HTTP for backend communication and rely on Azure's private network security.

rgds, Alex

a small add - normally recommended architecture is

Internet User → HTTPS (443) → App Gateway Standard_v2 → HTTP (8080) → NiFi Container
Try to modify your NiFi configuration to - Disable HTTPS for internal communication

• Keep HTTP listener on port 8080 (or your chosen port)

#In nifi.properties

nifi.web.https.host= #Leave empty to disable HTTPS

nifi.web.http.host=0.0.0.0

nifi.web.http.port=8080

Configure Application Gateway for HTTPS Termination

For frontend Configuration:

• Create a frontend listener on port 443 with your public certificate
• This handles SSL termination at the gateway

For backend Configuration:

• Point to your NiFi container's IP/port (8080)
• Use HTTP protocol (not HTTPS) for backend communication
• Configure health probes to use HTTP

Since internal traffic will be HTTP restrict NiFi container access to only the Application Gateway's private IP. Use NSG rules to block direct internet access to NiFi .Consider adding a Web Application Firewall (WAF) policy if needed. May be tha would help. Let me to knw if so

rgds,

Alex