Cloudera Docs

Configuring TLS/SSL for Apache Atlas

Configure TLS/SSL for Apache Atlas if you do not use the Cloudera Manager Auto-TLS.

Typically you would configure TLS for Atlas by using the Cloudera Manager Auto-TLS option. If you need to change these settings or want to understand more about the values set by Cloudera Manager, configure TLS/SSL for Apache Atlas.
  1. In Cloudera Manager, select the Atlas service, then go to the Configuration tab.
  2. Under Category, select Security.
  3. Set or update the following properties:
    Table 1. Apache Atlas TLS/SSL settings
    Grouping Configuration property Description
    Turn on TLS

    Enable TLS/SSL for Atlas Server

    atlas.enableTLS

    		 Select this checkbox to encrypt Atlas server communication using Transport Layer Security (TLS) (formerly known as Secure Socket Layer (SSL)). This option enables TLS for communication between clients and Atlas Server, between the Atlas Server as a client and services it depends on, such as HBase, and between the Atlas Gateway server and Kafka messaging topics.
    Private key management Atlas Server TLS/SSL Server JKS Keystore File Location

    keystore.file

    		 The path to the TLS/SSL keystore file containing the server certificate and private key Atlas uses to prove its own identity when it receives communication from other applications using the public key identified in Atlas Server TLS/SSL Client Trust Store File. The keystore must be in JKS format.
    Atlas Server TLS/SSL Server JKS Keystore File Password

    keystore.password

    		 The password that allows access to the Atlas Server JKS keystore file.
    Atlas Server TLS/SSL Server JKS Keystore File Password

    password

    		 The password that protects the Atlas Server private key contained in the JKS keystore.
    Public key management Atlas Server TLS/SSL Client Trust Store File

    truststore.file

    		 The path to a TLS/SSL public key trust store file, in .jks format, that contains Atlas server public key. This trust store must contain the certificate(s) used to sign the connected service(s). If this parameter is not provided, the default list of well-known certificate authorities is used instead.
    Atlas Server TLS/SSL Client Trust Store Password

    truststore.password

    		 (Optional) The password for the Atlas Server TLS/SSL Certificate trust store file. This password is not required to access the trust store; this field can be left blank. This password provides optional integrity checking of the file. The contents of trust stores are certificates, and certificates are public information.
    Gateway TLS/SSL Client Trust Store File

    atlas.kafka.ssl.truststore.location

    		 The path to the trust store file, in .jks format, used to confirm the authenticity of TLS/SSL servers that the Atlas Gateway might connect to. This trust store must contain the certificate(s) used to sign the service(s) connected to. If this parameter is not provided, the default list of well-known certificate authorities is used instead.

    Typically, this file is the same file listed in the truststore.file.
    Gateway TLS/SSL Client Trust Store Password

    atlas.kafka.ssl.truststore.password

    		 The password for the Gateway TLS/SSL Certificate trust store file. This password is not required to access the trust store; this field can be left blank. This password provides optional integrity checking of the file. The contents of trust stores are certificates, and certificates are public information.
    TLS protocol and cipher configuration TLS protocols for Atlas Server

    atlas.ssl.enabled.protocols

    Mapped from the supported_tls_versions or adv_supported_tls_versions Cloudera Manager properties.

    		 Specifies the TLS protocol versions enabled for Atlas.When the tls-advanced-control flag is disabled (the default), Cloudera Manager uses the legacy TLS 1.2 configuration and these advanced properties are hidden. When the flag is enabled, the default value is copy_from_global, which inherits global TLS protocol settings from Cloudera Manager. To use TLS 1.3, ensure that TLSv1.3 is included. The default protocol is TLS 1.2 when you do not use these advanced settings.
    Cipher suites for Atlas Server

    atlas.ssl.enabled.algorithms

    (mapped from Cloudera Manager properties tls_ciphers or adv_tls_ciphers_list)

    		 Specifies the cipher suites that are compatible with the selected TLS protocols 1 When the tls-advanced-control flag is disabled (the default), these advanced properties are hidden. When the flag is enabled, the default value is copy_from_global. The ciphers must be compatible with the selected TLS protocol. If you set copy_from_global for the TLS protocol, set copy_from_global for the algorithms as well to avoid mismatches. A mismatch (for example, global TLS protocol with custom incompatible ciphers) can prevent Atlas from starting because Atlas does not fall back to TLS 1.2 ciphers automatically.
    1
  4. Click Save Changes.
  5. Restart the Atlas service.