anchor.diff:           e2:03:f0:af:68:c5:c1:12:88:3e:c4:f0:30:d5:28:18:7e:e0:
            b3:e2:b9:4c:dc:17:51:6b:9e:33:df:ea:0e:95:cf:31:6f:37:
            7b:c3:c4:37
  -```
  +----
   
   ==== nifi-key.key
   
  -```
  +[source]
  +----
   # The first command shows the actual content of the encoded file, and the second parses it and shows the internal values
   
   .../certs $ more nifi-key.key
  
positive.code:   * If the DER file only contains the public certificate, use this command:
    ** `openssl x509 -inform der -in cert.der -out cert.pem`
  . To convert from a PKCS12 keystore (`keystore.p12`) containing both the public certificate and private key into PEM encoded files (`$PASSWORD` is the keystore password):
    * `openssl pkcs12 -in keystore.p12 -out cert.der -nodes -password "pass:$PASSWORD"`
    * `openssl pkcs12 -in keystore.p12 -nodes -nocerts -out key.key -password "pass:$PASSWORD"`
    * Follow the steps above to convert `cert.der` to `cert.pem`
  . To convert from a Java Keystore (`keystore.jks`) containing private key into PEM encoded files (`$P12_PASSWORD` is the PKCS12 keystore password, `$JKS_PASSWORD` is the Java keystore password you want to set, and `$ALIAS` can be any value -- the NiFi default is `nifi-key`):
    * `keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -srcstoretype JKS -deststoretype PKCS12 -destkeypass "$P12_PASSWORD" -deststorepass "$P12_PASSWORD" -srcstorepass "$JKS_PASSWORD" -srcalias "$ALIAS" -destalias "$ALIAS"`
    * Follow the steps above to convert from `keystore.p12` to `cert.pem` and `key.key`
  
negative.code: 
  As an example of how the tool works, assume that you have installed the tool on a machine supporting 256-bit encryption and with the following existing values in the _nifi.properties_ file:
  
  [source]
  ----
  # security properties #
  nifi.sensitive.props.key=thisIsABadSensitiveKeyPassword
  nifi.sensitive.props.algorithm=PBEWITHMD5AND256BITAES-CBC-OPENSSL
  