In addition to configuring Cloudera Manager cluster to use TLS/SSL (as detailed in Manually Configuring TLS Encryption for Cloudera Manager), the various CDH services running on the cluster should also be configured to use TLS/SSL. The process of configuring TLS/SSL varies by component, so follow the steps below as needed for your system. Before trying to configure TLS/SSL, however, be sure your cluster meets prerequisites.

In general, all the roles on any given node in the cluster can use the same certificates, assuming the certificates are in the appropriate format (JKS, PEM) and that the configuration properly points to the location. If you follow the steps in How to Configure TLS Encryption for Cloudera Manager to create your CSRs and use the symbolic link for the path to the certificates, you will be setting up the certificates in the cluster for optimal reuse.

  Note: TLS/SSL for Hadoop core services—HDFS, MapReduce, and YARN—must be enabled as a group. TLS/SSL for other components such as HBase, Hue, and Oozie can be enabled independently.

Not all components support TLS/SSL, nor do all external engines support TLS/SSL. Unless explicitly listed in this guide, the component you want to configure may not currently support TLS/SSL. For example, Sqoop does not currently support TLS/SSL to Oracle, MySQL, or other databases.