Cloudera Docs

Configuring TLS/SSL encryption manually for Apache Knox

If you do not want to enable Auto-TLS because, for example, you need to use your own enterprise-generated certificates, you can manually enable TLS for Apache Knox.

Starting in Cloudera Runtime 7.3.2 SP1 (7.3.2.10000), Cloudera Manager controls Knox Gateway TLS protocols and cipher suites through the CMF_FF_TLS_ADVANCED_CONTROL feature flag.

When you enable CMF_FF_TLS_ADVANCED_CONTROL, configure Knox using the Supported SSL/TLS versions and TLS Cipher List parameters on the Knox service configuration page. Cloudera Manager maps these settings to ssl.include.protocols and ssl.include.ciphers in the Knox Gateway gateway-site.xml configuration.

When CMF_FF_TLS_ADVANCED_CONTROL is disabled, configure Knox using the Knox TLS - Protocols and Knox TLS - Cipher Suites parameters on the Knox service configuration page.

  • Review certificate requirements. See TLS/SSL certificate requirements and recommendations for more information.
  • Review Understanding Keystores and Truststores.
  • Create certificates and configure Cloudera Manager properties. See Manually Configuring TLS Encryption for Cloudera Manager for more information. Configuring TLS Encryption for Cloudera Manager Admin Console is required prior to enabling TLS encryption for Knox.
  1. From the Cloudera Manager site, go to Clusters > Knox.
  2. Click the Configuration tab.
  3. Enter tls in the search field. The TLS and security properties appear.
  4. Configure Knox TLS protocols and cipher suites based on the state of the CMF_FF_TLS_ADVANCED_CONTROL feature flag.
    • If CMF_FF_TLS_ADVANCED_CONTROL is enabled, configure the Supported SSL/TLS versions and TLS Cipher List parameters on the Knox configuration page.
      • For Supported SSL/TLS versions, select TLSv1.2, TLSv1.3, TLSv1.2, and TLSv1.3, or Copy From Global Settings to inherit global TLS protocol settings from Cloudera Manager.
      • For TLS Cipher List, enter cipher suites or use {{COPY_FROM_GLOBAL}} to inherit global TLS cipher settings from Cloudera Manager.
      Configure global TLS settings in Cloudera Manager as described in Transport Layer Security Support and Custom Protocol Configuration.
    • If CMF_FF_TLS_ADVANCED_CONTROL is disabled, configure the Knox TLS - Protocols and Knox TLS - Cipher Suites parameters as needed.
  5. Edit the remaining TLS security properties according to your cluster configuration.
    For a list of security properties, see Knox Properties in Cloudera Runtime.
  6. If Cloudera Manager Server TLS settings differ from the global cluster configuration, configure Knox service discovery TLS settings to match the Cloudera Manager Server configuration.
  7. Click Save Changes.
  8. Restart the Knox service.