Configuring TLS versions

Configure allowed TLS versions, define cipher suite inclusion lists, and deploy updated settings for YARN services in Cloudera Manager.

Configure allowed TLS versions.
1. In Cloudera Manager, navigate to Clusters > YARN > Configuration.
2. Search for Supported SSL/TLS Versions (hadoop.ssl.enabled.protocols).
3. Select the desired TLS versions from the dropdown list, such as, TLSv1.2 or TLSv1.3.
4. Select Copy from Global Settings if you want YARN to dynamically inherit the cluster-wide default.
note
Client-side TLS consistency – Selecting a version updates server-side TLS and automatically injects the JVM argument -Djdk.tls.client.protocols = <versions> into the following core YARN components:
- ResourceManager
- NodeManager
- JobHistory Server
- MapReduce ApplicationMaster
This ensures outbound or client-side TLS communication remains aligned across all hosted processes.
Define the cipher suite inclusion list.
1. In YARN Configuration, search for TLS Cipher Suite Inclusion List (ssl.server.include.cipher.list).
2. Enter or select the exact cipher suites permitted for YARN TLS communication.
  
  note
  Any cipher not present in this list will be denied.
note
Legacy Behavior – On Cloudera Runtime7.3.2 SP1, when advanced TLS control is enabled, the legacy regex-based exclusion setting is hidden in favor of this inclusion list. On releases prior to 7.3.2 SP1 (or if Advanced TLS Control is disabled), YARN retains its legacy regex exclusion behavior without disruption.
Deploy configurations and restart services.
1. Click Save Changes in Cloudera Manager.
2. Deploy client configurations if prompted.
3. Perform a stale service restart for the YARN service (ResourceManager, NodeManager, JobHistory Server) to apply changes across the cluster.