Enforcing TLS 1.3 version for Cloudera Data Explorer (Hue)

Data Explorer communicates by using TLS version 1.3 as the security protocol. You can enforce TLS version 1.3 by configuring the SSL protocol property and cipher suite definitions in Cloudera Manager.

To use TLS version 1.3, ensure that your environment meets the following requirements:

Python 3.11 or higher
OpenSSL 3.5.5 or higher

Sign in to Cloudera Manager as an Administrator.
Go to Clusters > Data Explorer (Hue) > Configuration > Load Balancer and add the following line in the SSL Protocol field:
```
+TLSv1.3
```
In the SSLCipherSuite field, remove the default cipher suite and retain only the following cipher list:
```
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-GCM-SHA384
!DSS
```
Click Save Changes.
Go to Clusters > Data Explorer (Hue) > Configuration > Data Explorer Server and add the following lines in the Data Explorer Service Advanced Configuration Snippet (Safety Valve) field:
```
[desktop]
ssl_tls13_enabled=true
```
Click Save Changes.
Restart the Data Explorer service.
To confirm that the service strictly enforces TLS 1.3 and uses a strong, approved cipher suite, run the following commands against the target port:
1. Open a CLI console on a machine in your cluster.
2. SSH into the Data Explorer server host as a root user.
3. Before running the command, obtain the Load Balancer and Data Explorer server service web address.
  1. Log in to Cloudera Manager.
  2. Go to Clusters > Data Explorer (Hue) > Configuration > Web UI and copy both the Load Balancer and Data Explorer server service web address.
Run the appropriate command for each port:
1. Port 8889:
```
curl -vk [***HOST NAME***]:8889/ 2>&1 | grep "SSL connection"
```
  The example output shows a successful TLS 1.3 connection and the supported cipher suite:
```
SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
```
2. Port 8888:
```
curl -vk [***HOST NAME***]:8888/ 2>&1 | grep "SSL connection"
```
  The example output shows a successful TLS 1.3 connection and the supported cipher suite:
```
SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
```