Enabling TLS 1.3 and Customizing Cipher Suites in Cloudera Manager

Configuring the Global TLS Protocol Version

Use the Cloudera Manager UI to configure the active TLS protocol version applied across all cluster services.

How global TLS version selection works

Cloudera Manager applies a single global TLS version setting (Administration > Settings > Supported SSL/TLS versions) that all cluster services inherit by default. The default value is TLSv1.2 and TLSv1.3 (combined). You do not need to take any action unless your security policy requires restricting or changing this default.

Cluster services inherit this setting when you set their per-service TLS version parameter to Copy From Global Settings. You can override this setting on individual services if a specific component requires a different protocol version.

Steps

Navigate to SSL/TLS settings:
1. Log in to the Cloudera Manager UI as an administrator.
2. Navigate to Administration > Settings.
3. Type Supported SSL/TLS versions into the configuration search bar.
Configure the TLS version only if you need to override the default. Cloudera Manager defaults to TLSv1.2 and TLSv1.3. Change this setting only when your security policy requires a different version:
Select your preferred configuration from the property dropdown menu:
1. Choose TLSv1.3 to enable TLS 1.3 exclusively.
2. Choose TLSv1.2, and TLSv1.3 to enable both versions simultaneously.
3. Choose TLSv1.2 to enable TLS 1.2 exclusively.
Save changes and restart the Cloudera Manager:
1. Click Save Changes.
2. Log in to your terminal host and restart Cloudera Manager Server through SSH:
```
sudo systemctl restart cloudera-scm-server
```
Verify Log output:
1. Run the following search against the server log directory to confirm success:
```
cat /var/log/cloudera-scm-server/cloudera-scm-server.log | grep "Configured TLS versions"
```

Configuring Global Cipher Suites

Use the Cloudera Manager UI to edit the global cipher distribution list and manage cluster component inheritance behaviors.

How Cipher distribution works

Cloudera Manager pushes the global cipher list (Administration > Settings > TLS Cipher List) to cluster services.
Services use these ciphers when their individual TLS cipher parameter is set to Copy From Global Settings (stored internally as {{COPY_FROM_GLOBAL}}).
Service-Specific Ciphers: You can customize the cipher list for individual services through the TLS options on that specific service configuration page.
Java format requirements: You must enter ciphers in Java (JSSE) format (for example, TLS_AES_256_GCM_SHA384). For services that require OpenSSL format (such as Impala), Cloudera Manager automatically translates Java cipher names to OpenSSL equivalents during configuration deployment. Formatting errors can cause unexpected behavior or complete system failures.

Navigate to Cloudera Manager Global TLS Cipher List Settings:
1. Log in to the Cloudera Manager UI as an administrator.
2. Navigate to Administration > Settings.
3. Type TLS Cipher List into the search input.
Edit the Cloudera Manager Global TLS Cipher List:
1. The text box shows the current cipher list. Cloudera Manager supplies this list to services, which use it to establish their cipher configurations.
  
  Modify the list to include your preferred cipher suites. Ensure you type the ciphers in the correct format (for example, TLS_AES_256_GCM_SHA384), which complies with the Java-based TLS Cipher format.
  
  By default, the list contains:
```
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
```
Click Save Changes.
Restart all services that use the Global TLS Cipher Suite, as the configuration change makes their current status stale.

Configuring Cloudera Manager Server default TLS Ciphers

By default, the Cloudera Manager Server uses a predefined set of hardcoded TLS ciphers to secure communications. To meet specific organizational security policies or compliance standards, administrators can override these default ciphers by defining a custom cipher list using the CMF_OVERRIDE_TLS_CIPHERS environment variable in the /etc/default/cloudera-scm-server configuration file.

Once you enable the required feature flags, the server activates the supported TLS 1.2 and TLS 1.3 cipher suites.

Active Cipher Suites

Upon enabling the required feature flags, Cloudera Manager Server activates the following cipher suites:

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Overriding Cloudera Manager Server TLS Ciphers

This section describes how administrators can override the hardcoded default ciphers by defining a custom cipher list in the Cloudera Manager Server configuration file to meet specific security or compliance requirements.

When you enable CMF_FF_TLS_ADVANCED_CONTROL, the Cloudera Manager Server uses a hardcoded cipher list by default. To choose custom TLS ciphers for the Cloudera Manager Server:

Edit the server configuration file:
```
/etc/default/cloudera-scm-server
```

Add your custom ciphers using the Java format (replace the placeholder text with your choice of ciphers):

export CMF_OVERRIDE_TLS_CIPHERS="TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"

Restart the Cloudera Manager Server to apply the changes:
```
sudo systemctl restart cloudera-scm-server
```

Configuring TLS Protocol Versions and Ciphers for Cloudera Manager Agents

Administrators can enforce specific TLS protocols and ciphers on individual host agents by modifying the local Agent configuration file. Explicit values configured in this file take precedence over server defaults.

How Agent TLS defaults work

When you enable CMF_FF_TLS_ADVANCED_CONTROL, the Cloudera Manager Server automatically pushes the following defaults to all host agents during heartbeats without requiring manual configuration:

Cipher list: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
Minimum TLS protocol: TLSv1.2

Agent Security Settings

Configure the TLS parameters under the [Security] section of /etc/cloudera-scm-agent/config.ini on each host:


Parameter	Accepted Format	Description
`minimum_tls_protocol`	Protocol string (for example, `TLSv1.3`)	Specifies the lowest TLS/SSL protocol version the agent negotiates.
`cipher_list`	OpenSSL cipher string	Enforces ciphers for outbound connections to the Cloudera Manager Server.
`server_cipher_list`	OpenSSL cipher string	Enforces ciphers for inbound connections to the agent's status server.

Steps

Edit /etc/cloudera-scm-agent/config.ini on the target host, uncomment the parameters under the [Security] section, and set your desired values:
```
[Security]
minimum_tls_protocol=TLSv1.3
cipher_list=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
server_cipher_list=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
```
You can override any subset of these parameters independently. Parameters that you leave unconfigured use server-pushed defaults.

important

When you update or configure cipher suites and TLS protocols on a Cloudera Manager Agent host, ensure they overlap with the settings configured on the Cloudera Manager Server. If no overlap exists between the two, the SSL/TLS handshake fails, and the agent cannot connect to the server.
Restart the Cloudera Manager Agent to apply the change:
```
sudo systemctl restart cloudera-scm-agent
```

These steps allow you to enable TLS 1.3 for Cloudera Manager with the correct ciphers for your services. This process ensures enhanced security for all encrypted communications across your network.

Cipher naming format reference

This section details the cipher naming syntax requirements across Java-based and OpenSSL-based cluster components.

Different components require specific cipher naming formats:


Component	Expected Format	Example Cipher String
Cloudera Manager Server, HDFS, YARN, HBase, Hive, ZooKeeper, Kafka, Ranger, Oozie, Solr	Java (JSSE)	`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
Cloudera Manager Agent	OpenSSL	`ECDHE-RSA-AES256-GCM-SHA384`
TLS 1.3 Ciphers (Both Formats)	Identical in both	`TLS_AES_256_GCM_SHA384`

Cloudera Manager automatically converts Java cipher names to OpenSSL equivalents for services that require OpenSSL format when inheriting from the global cipher list.