Configuring TLS Encryption for Cloudera Manager Admin Console
This level of security is for users connecting to the Cloudera Manager Admin console.
Step 1: Create a Cloudera Manager Server certificate.
If you have already completed this step when configuring TLS encryption for Cloudera Manager, you do not need to repeat it.
- Use keytool to generate a certificate for the Cloudera Manager Server. For example:
$ keytool -validity 180 -keystore <path-to-keystore> -alias jetty -genkeypair -keyalg RSA
- The -validity option specifies the certificate lifetime in number of days. If no validity value is specified, the default value is used. The default varies, but is often 90 days.
- The <path-to-keystore> must be a path to where you want to save the keystore file, and where the Cloudera Manager Server host machine can access.
- When prompted by keytool, create a password for the keystore. Save the password in a safe place.
- When prompted by keytool, fill in the answers accurately to the questions to describe you and your company. The most important answer is the CN value for the question "What is your first and last name?" The CN must match the fully-qualified domain name (FQDN) or IP address of the host machine where the Server is running. For example, cmf.company.com or 192.168.123.101.
Step 2: Enable TLS encryption and specify Server keystore properties.
- Log into the Cloudera Manager Admin Console.
- From the Administration tab select Settings, then go to the Security category.
- Configure the following three TLS settings:
Setting Description Use TLS Encryption for Admin Console Select this option to enable TLS encryption between the Server and user's web browser. Path to TLS Keystore File Specify the full filesystem path to the keystore file. Keystore Password Specify the password for keystore.
- Click Save Changes to save the settings.
Step 3: Restart the Cloudera Manager Server.
Restart the Cloudera Manager Server with the following command to activate the TLS configuration settings.
$ sudo service cloudera-scm-server restart
Log out and then log in into Cloudera Manager to test the certificate. You may see an warning message to accept the certificate if the root certificate is not installed in your browser.
Step 4: Restart the Cloudera Management Services.
Restart the Cloudera Management Services by clicking the Services link and choosing Restart on the Actions menu for the Cloudera Management Services. Click Restart that appears in the next screen to confirm. When you see a Finished status, the service has restarted.
Step 5: Verify that the Server and browser are using TLS to communicate.
Open the Cloudera Manager Admin Console page in your browser. Every browser has its own way of indicating a successful TLS connection. Some browsers indicate this by displaying a lock icon in the URL bar while others display an error message if the connection is unencrypted.