Install and configure additional required components
Use the following steps to install additional required components for FIPS.
- Perform the Additional Steps for Apache Ranger.
Install and Configure TLS either automatically or manually.
If you are using Auto-TLS, see:If you are manually configuring TLS, see:
Generate certificates in BCFKS format
keytoolutility distributed with the JDK can generate BCFKS formatted keystores using the CCJ security provider. When the CCJ security provider is statically installed into the JDK as previously described, there is no need to pass the
-providerclass com.safelogic.cryptocomply.jcajce.provider.ProvBCFKSarguments. It is only necessary to pass
BCFKSas the storetype for the
keytooloperation being invoked.
keytool -importkeystorecan be used to import a PKCS12 keystore into a BCFKS keystore:
keytool \ -importkeystore -v \ -srckeystore <pkcs12_keystore_file> \ -srcstoretype PKCS12 \ -srcstorepass <pkcs12_pass> \ -destkeystore <bcfks_keystore_file> \ -deststoretype BCFKS \ -deststorepass <bcfks_keystore_pass> \ -destkeypass <bcfks_key_pass>
Systems administrators and other platform implementers should consult their organization’s information systems security managers for the correct procedures for generating keypairs and requesting signing of x509 certificates. The Cloudera Data Platform requires the private key and signed certificate in both PEM encoded and BCFKS keystore format. The steps to accomplish this task might look similar to the following:
- Have the CA sign the CSR.
Import the private key and signed certificate into a PKCS12
Import the PKCS12 keystore into a BCFKS keystore:
- Enable Kerberos authentication using the Cloudera Manager Kerberos wizard.
- Install Apache Knox. See Installing Apache Knox.
- Install Cloudera Navigator Key Trustee Server. See Installing Cloudera Navigator Key Trustee Server.
- Install Ranger KMS with Key Trustee Server. See Installing Ranger KMS with Key Trustee Server.
- Configure HDFS Transparent Data Encryption with Ranger KMS with Key Trustee Server.