After struggling with many solutions from internet, I found a trick to resolve the issue. Set the hostname of the docker to IP address u deploy to. It will generate valid certs. But also set the env NIFI_WEB_HTTPS_PORT=0.0.0.0 so it won't encounter binding error