4.1. Set Up HTTPS for Ambari Server

If you want to limit access to the Ambari Server to HTTPS connections, you need to provide a certificate. While it is possible to use a self-signed certificate for initial trials, they are not suitable for production environments. Once your certificate is in place, you must run a special setup command.

	Important
	Ambari Server should not be running when you do this. Either make these changes before you start Ambari the first time, or bring the server down before running the setup command.

Log into the Ambari Server host.

Locate your certificate. If you want to create a temporary self-signed certificate, use this as an example:

openssl genrsa -out $wserver.key 2048 
openssl req -new -key $wserver.key -out $wserver.csr  
openssl x509 -req -days 365 -in $wserver.csr -signkey $wserver.key -out $wserver.crt

Where $wserver is the Ambari Server hostname.

Important

The certificate you use must be PEM-encoded, not DER-encoded. If you attempt to use a DER-encoded certificate, you see this error:

unable to load certificate
140109766494024:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c 
:698:Expecting: TRUSTED CERTIFICATE

You can convert a DER-encoded certificate to a a PEM-encoded certificate using the following command:

openssl x509 -in cert.crt -inform der -outform pem -out cert.pem

where cert.crt is the DER-encoded certificate and cert.pem is the resulting PEM-encoded certificate.

Run the special setup command and answer the prompts
```
ambari-server setup-security
```
1. Select 1 for Enable HTTPS for Ambari server.
2. Respond y to Do you want to configure HTTPS?
3. Select the port you want to use for SSL. Default is 8443.
4. Provide the path to your certificate and your private key.
5. Provide the password for the private key.
6. Start or restart the Server
```
ambari-server restart
```

Legal notices