Configuring the TLS versions for Phoenix

Standardized TLS version configuration in Cloudera Manager unifies encryption parameters across database engines by using a dual-parameter model and a central feature flag. Cloudera Manager controls Transport Layer Security (TLS) versions through the TLS_ADVANCED_CONTROL feature flag. This feature flag manages whether database components utilize legacy configurations or adopt the standardized architecture introduced in Cloudera Manager 7.13.2 SP1. The dual-parameter model decouples tracking from properties emitted into configuration files, which allows two distinct configurations to resolve to the same property name.

The feature flag determines parameter behavior and user visibility based on its state:

• When you disable the feature flag (OFF), components exhibit legacy behavior, maintaining pre-existing parameters and defaults to ensure zero impact on current deployments.
• When you enable the feature flag (ON), components automatically transition to unified specifications, allow access to TLS v1.3 options, and ignore pre-existing values in favor of centralized defaults.

The framework automatically manages visibility and configuration file generation according to the state of the flag. The following table compares the legacy and unified parameter specifications for protocol control:

The unified approach sets Copy from Global as the default selection, enabling your database instances to inherit settings directly from the global Cloudera Manager configuration. To maintain a secure environment, all versions older than TLS v1.2 are deprecated and removed from the unified setup . If you use custom settings, you must explicitly plan your migration to ensure compatibility.