Cloudera Docs

Migrating from FIPS 140-2 to FIPS 140-3

Migrate your FIPS 140-2 workloads to a FIPS 140-3 cluster in Cloudera Base on premises by establishing mutual trust stores and Java environment options between source and destination hosts.

Perform a fresh installation of 7.3.2 SP1 to provision a FIPS 140-3 cluster, and migrate your workloads from the existing FIPS 140-2 cluster:

  1. Locate the internal Certificate Authority (CA) certificate on the source cluster. On clusters where AutoTLS is enabled, this is stored on the Cloudera Manager Server host.
    cat /opt/cloudera/CMCA/trust-store/cm-auto-in_cluster_ca_cert.pem
  2. Copy the extracted cm-auto-in_cluster_ca_cert.pem file from the source cluster to all hosts within the destination cluster.
  3. On the destination cluster's Cloudera Manager Server host, query the backend database to find the required truststore password. The following example assumes a local PostgreSQL deployment: 
    sudo -u postgres psql
-- Connect to the CM database
\c [cm_database]
-- Retrieve the truststore password
SELECT * FROM CONFIGS WHERE attr LIKE 'truststore_password';
  4. Run the following command on all hosts in the destination cluster to import the source cluster's CA certificate into the BCFKS-formatted truststore. 
    /usr/java/default/bin/keytool -storetype BCFKS \
  -provider com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider \
  -providerpath /opt/cloudera/fips/[ccj_JAR_path] \
  -importcert -alias cmrootca-source \
  -keystore /var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks \
  -storepass [truststore_password] \
  -file [/path/to/cm-auto-in_cluster_ca_cert.pem]
  5. To complete the two-way trust, repeat steps 1 through 4, but reverse the roles. Extract the CA from the destination cluster and import it into the truststore of all hosts in the source cluster. Use a unique alias, such as cmrootca-destination.
  6. For services such as Ozone replication on FIPS clusters, you must ensure Java clients use the correct BCFKS truststore. Create an environment script on all hosts to specify the global truststore and its credentials. 
    echo "export JDK_JAVA_OPTIONS='--module-path=/opt/cloudera/fips/ccj-[version].jar:/opt/cloudera/fips/bctls.jar --add-exports java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core --add-modules com.safelogic.cryptocomply.fips.core,bctls -Djavax.net.ssl.trustStore=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks -Djavax.net.ssl.trustStoreType=BCFKS -Djavax.net.ssl.trustStorePassword=[truststore_password]'" > /etc/profile.d/ccj.sh
sudo chmod +x /etc/profile.d/ccj.sh