Cloudera Docs

Configuring the TLS versions for HBase

Know how to configure the TLS versions for HBase using Cloudera Manager. It is essential to configure these versions to enforce modern security standards, access advanced encryption, and streamline management.

Standardized TLS version configuration in Cloudera Manager unifies encryption parameters across managed services by using a dual-parameter model and a central feature flag. Cloudera Manager manages Transport Layer Security (TLS) versions through the TLS_ADVANCED_CONTROL feature flag. This feature flag controls whether services utilize legacy configurations or adopt the standardized architecture introduced in Cloudera Manager 7.13.2 SP1. The dual-parameter model separates internal tracking from properties emitted into service configuration files, which allows two distinct configurations to resolve to the same configuration file property.

The feature flag determines parameter behavior and visibility:

  • When the feature flag is disabled (OFF), services exhibit legacy behavior, maintaining previous parameters and default values to prevent disruption to existing deployments.
  • When the feature flag is enabled (ON), services automatically transition to the unified specifications, access TLS v1.3 options, and ignore legacy customer values in favor of centralized defaults.

The framework automatically handles parameter visibility and emission into configuration files based on the active state of the feature flag. The following table compares the legacy and unified parameter specifications for TLS version control:

The unified model defaults to the Copy from Global setting. This option enables services to directly inherit version requirements from the global Cloudera Manager configuration. By default, the central manager resolves this setting to TLS v1.2 unless you manually update the global properties. Older protocol versions below TLS v1.2 are completely removed from the unified specification to enforce modern security standards.

  1. Log in to the Cloudera Manager as an administrator.
  2. Select the HBase service.
  3. Click the Configuration tab.
  4. Search for tls_version.
  5. Select any of the following Supported SSL/TLS versions for HBASE-1 (Service-Wide) or HBase Web UIs, HBase REST Server, HBase Thrift Server, HBase Master, or HBase RegionServer.
    • TLSv1.2: Enable TLS 1.2 exclusively.
    • TLSv1.3: Enable TLS 1.3 exclusively.
    • TLSv1.2, and TLSv1.3: Enable both the versions simultaneously.
    • Copy From Global Settings: Inherit cipher settings directly from Cloudera Manager's global TLS configuration.