Migrating from FIPS 140-2 to FIPS 140-3

Migrate your FIPS 140-2 workloads to a FIPS 140-3 cluster in Cloudera Base on premises by establishing mutual trust stores and Java environment options between source and target hosts.

Perform a fresh installation of 7.3.2 SP1 to provision a FIPS 140-3 cluster, and migrate your workloads from the existing FIPS 140-2 cluster.

Your environment must meet the following conditions:

Hive external table replication – To enable Hive replication between FIPS-enabled clusters, the source cluster must run Cloudera Manager 7.13.1.800 or higher versions.
HBase replication – Direct HBase replication is not supported.The migration requires exporting HBase tables to HDFS, transferring them to the target cluster by HDFS replication, and importing them back into HBase. HBase tables can be exported in multiple ways, including using snapshots. For instructions, see Configuring HBase snapshots.

Locate the internal Certificate Authority (CA) certificate on the source cluster. On clusters with AutoTLS enabled, this is stored on the Cloudera Manager Server host.
```
cat /opt/cloudera/CMCA/trust-store/cm-auto-in_cluster_ca_cert.pem
```
Copy the extracted cm-auto-in_cluster_ca_cert.pem file from the source cluster to all hosts within the target cluster.
On the target cluster Cloudera Manager Server host, query the backend database to find the required truststore password. The following example assumes a local PostgreSQL deployment:
```
sudo -u postgres psql
-- Connect to the CM database
\c [cm_database]
-- Retrieve the truststore password
SELECT * FROM CONFIGS WHERE attr LIKE 'truststore_password';
```

Run the following command on all hosts in the targe cluster to import the source cluster CA certificate into the BCFKS-formatted truststore.

/usr/java/default/bin/keytool -storetype BCFKS \
  -provider com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider \
  -providerpath /opt/cloudera/fips/[ccj_JAR_path] \
  -importcert -alias cmrootca-source \
  -keystore /var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks \
  -storepass [truststore_password] \
  -file [/path/to/cm-auto-in_cluster_ca_cert.pem]

To complete the two-way trust, repeat steps 1 through 4, but reverse the roles. Extract the CA from the target cluster and import it into the truststore of all hosts in the source cluster. Use a unique alias, such as cmrootca-target.

For services such as Ozone replication on FIPS clusters, you must ensure Java clients use the correct BCFKS truststore. Create an environment script on all hosts to specify the global truststore and its credentials.

echo "export JDK_JAVA_OPTIONS='--module-path=/opt/cloudera/fips/ccj-[version].jar:/opt/cloudera/fips/bctls.jar --add-exports java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core --add-modules com.safelogic.cryptocomply.fips.core,bctls -Djavax.net.ssl.trustStore=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks -Djavax.net.ssl.trustStoreType=BCFKS -Djavax.net.ssl.trustStorePassword=[truststore_password]'" > /etc/profile.d/ccj.sh
sudo chmod +x /etc/profile.d/ccj.sh