1. Log in to the Cloudera Manager Admin Console.
2. Select Administration > Settings.
3. Select the Security category.
4. Configure the following TLS settings:

   Property	Description
   Cloudera Manager TLS/SSL Server JKS Keystore File Location	The complete path to the keystore file. For example: /opt/cloudera/security/pki/server.jks
   Cloudera Manager TLS/SSL Server JKS Keystore File Password	The password for the /opt/cloudera/security/jks/server.jks keystore.
   Use TLS Encryption for Admin Console	Check this box to enable TLS encryption for Cloudera Manager.

5. Enter a Reason for Change, then click Save Changes to save the settings.

When enabling TLS for the Cloudera Manager Server admin interface, you must set the Java truststore location and password in the Cloudera Management Services configuration. Otherwise, roles such as Host Monitor and Service Monitor cannot connect to Cloudera Manager Server and will not start.

Configure the path and password for the $JAVA_HOME/jre/lib/security/jssecacerts truststore that you created earlier. Make sure that you have created this file on all hosts, including the Cloudera Management Service hosts, as instructed in Generate TLS Certificates.

1. Open the Cloudera Manager Administration Console and go to the Cloudera Management Service service.
2. Click the Configuration tab.
3. Select Scope > Cloudera Management Service (Service-Wide).
4. Select Category > Security.
5. Edit the following TLS/SSL properties according to your cluster configuration.

   Property	Description
   TLS/SSL Client Truststore File Location	The path to the client truststore file used in HTTPS communication. This truststore contains certificates of trusted servers, or of Certificate Authorities trusted to identify servers. For this example, set the value to: <JAVA_HOME>/jre/lib/security/jssecacerts Replace <JAVA_HOME> with the path to the Oracle JDK.
   Cloudera Manager Server TLS/SSL Certificate Trust Store Password	The password for the truststore file.

6. Click Save Changes to commit the changes.

You must restart both Cloudera Manager Server and the Cloudera Management Service for TLS encryption to work. Otherwise, the Cloudera Management Services (such as Host Monitor and Service Monitor) cannot communicate with Cloudera Manager Server.

1. Restart the Cloudera Manager Server by running the following command on the Cloudera Manager Server host:
   • RHEL 7 compatible:

     sudo systemctl restart cloudera-scm-server

   • RHEL 6 compatible, SLES, Ubuntu:

   • sudo service cloudera-scm-server restart

2. After the restart completes, connect to the Cloudera Manager Admin Console using the HTTPS URL (for example: https://cm01.example.com:7183). If you used an internal CA-signed certificate, you must configure your browser to trust the certificate. Otherwise, you will see a warning in your browser any time you access the Cloudera Manager Administration Console. By default, certificates issued by public commercial CAs are trusted by most browsers, and no additional configuration is necessary if your certificate is signed by one of them.
3. Restart the Cloudera Management Service (Cloudera Management Service > Actions > Restart).

Configure the TLS properties for Cloudera Manager Agents.

1. Restart the Cloudera Manager Server by running the following command on the Cloudera Manager Server host:
   • RHEL 7 compatible:

     sudo systemctl restart cloudera-scm-server

   • RHEL 6 compatible, SLES, Ubuntu:

   • sudo service cloudera-scm-server restart

2. On each agent host (including the Cloudera Manager Server host), restart the Cloudera Manager agent service:
   • RHEL 7 compatible:

     sudo systemctl restart cloudera-scm-agent

   • RHEL 6 compatible, SLES, Ubuntu:

   • sudo service cloudera-scm-agent restart

In the Cloudera Manager Admin Console, go to Hosts > All Hosts. If you see successful heartbeats reported in the Last Heartbeat column after restarting the agents, TLS encryption is working properly.

On each Cloudera Manager Agent host, use the keytool utility to export the private key and certificate to a PKCS12 file, which can then be split up into individual key and certificate files using the openssl command:

1. Export the private key and certificate:

   sudo $JAVA_HOME/bin/keytool -importkeystore \
   -srckeystore /opt/cloudera/security/pki/$(hostname -f).jks \
   -destkeystore /opt/cloudera/security/pki/$(hostname -f)-key.p12 \
   -deststoretype PKCS12 -srcalias $(hostname -f)

2. Use the openssl command to export the private key into its own file:

   sudo openssl pkcs12 \
   -in /opt/cloudera/security/pki/$(hostname -f)-key.p12 \
   -nocerts \
   -out /opt/cloudera/security/pki/$(hostname -f).key

3. Create a symbolic link for the .key file:

   sudo ln -s /opt/cloudera/security/pki/$(hostname -f).key \
   /opt/cloudera/security/pki/agent.key

   This allows you to use the same /etc/cloudera-scm-agent/config.ini file on all agent hosts rather than maintaining a file for each agent.

The Cloudera Manager agent obtains the password from a text file, not from a command line parameter or environment variable. The password file allows you to use file permissions to protect the password. For example, run the following commands on each Cloudera Manager Agent host, or run them on one host and copy the file to the other hosts:

Copy the file to all other cluster hosts. If you have modified properties such as listening_hostname or listening_ip address in config.ini, you must edit the file individually on each host.

1. Log in to the Cloudera Manager Admin Console.
2. Select Administration > Settings.
3. Click the Security category.
4. Configure the following TLS settings:

   Setting	Description
   Use TLS Authentication of Agents to Server	Select this option to enable TLS authentication of agents to the server.
   Cloudera Manager TLS/SSL Certificate Trust Store File	Specify the full filesystem path to the jssecacerts file located on the Cloudera Manager Server host. For this example, set the value to: <JAVA_HOME>/jre/lib/security/jssecacerts Replace <JAVA_HOME> with the path to the Oracle JDK.
   Cloudera Manager TLS/SSL Certificate Trust Store Password	Specify the password for the jssecacerts truststore.

5. Click Save Changes to commit the changes.

1. On the Cloudera Manager server host, restart the Cloudera Manager server:
   • RHEL 7 compatible:

     sudo systemctl restart cloudera-scm-server

   • RHEL 6 compatible, SLES, Ubuntu:

   • sudo service cloudera-scm-server restart

2. On every agent host, restart the Cloudera Manager agent:
   • RHEL 7 compatible:

     sudo systemctl restart cloudera-scm-agent

   • RHEL 6 compatible, SLES, Ubuntu:

   • sudo service cloudera-scm-agent restart

In the Cloudera Manager Admin Console, go to Hosts > All Hosts. If you see successful heartbeats reported in the Last Heartbeat column after restarting the agents and server, TLS certificate authentication is working properly. If not, check the agent log (/var/log/cloudera-scm-agent/cloudera-scm-agent.log) for errors.

For example, you might see the following error:

WrongHost: Peer certificate commonName does not match host, expected 192.0.2.155, got cdh-1.example.com
[02/May/2018 15:04:15 +0000] 4655 MainThread agent        ERROR    Heartbeating to 192.0.2.155:7182 failed

For this scenario, make sure that your DNS and /etc/hosts file are configured correctly, and that your server_host parameter in /etc/cloudera-scm-agent/config.ini uses the Cloudera Manager Server hostname, and not IP address.