Cloudera Docs

Configuring Replication Peers for advanced TLS controls on Cloudera on cloud clusters

Learn to verify TLS certificate trust and configure canonical hostname verification for Replication Peers. This procedure applies to upgrading Cloudera on cloud-based Cloudera Manager instances to version 7.13.2 SP1 (7.13.2.10000) with advanced TLS controls active.

Verifying source cluster TLS certificate trust

Ensure that the target Cloudera on cloud-based Cloudera Manager instance trusts the TLS certificates of all source clusters before enabling advanced TLS controls.

To prevent replication failures when activating CMF_FF_ENCRYPT_ALL_PORTS, verify that the target Cloudera Manager trusts the TLS certificate fingerprint of every source cluster:
  1. Identify target replication policies

    In Replication Manager on the upgraded target Cloudera Manager UI, navigate to Replication > Policies. Identify all policies where the upgraded Cloudera Manager serves as the replication target.

  2. Identify source clusters

    Match each target policy identified in Step 1 to its corresponding source cluster.

  3. Extract source certificate fingerprints
    Log in to each source Cloudera Manager host and retrieve the certificate fingerprint (typically stored under alias cmrootca-0):
    /usr/java/default/bin/keytool \
  -keystore $(xmllint --xpath "//property[name='ssl.client.truststore.location']/value/text()" /etc/hadoop/conf/ssl-client.xml) \
  -storepass $(xmllint --xpath "//property[name='ssl.client.truststore.password']/value/text()" /etc/hadoop/conf/ssl-client.xml) \
  -list | grep 'cmrootca-0' -A1
  4. List trusted certificates on the target host
    Log in to the upgraded target Cloudera Manager host and list all trusted certificates in its truststore:
    /usr/java/default/bin/keytool \
  -keystore $(xmllint --xpath "//property[name='ssl.client.truststore.location']/value/text()" /etc/hadoop/conf/ssl-client.xml) \
  -storepass $(xmllint --xpath "//property[name='ssl.client.truststore.password']/value/text()" /etc/hadoop/conf/ssl-client.xml) \
  -list
  5. Match fingerprints and establish trust:

    Compare the source certificate fingerprints from Step 3 against the target truststore output from Step 4. For any missing source fingerprint, perform the certificate exchange procedure described in Setting up SSL/TLS certificate exchange.

Configuring hostname verification for Replication Peers

Update IP-based Replication Peer definitions using the Cloudera Manager API to enable hostname verification for FQDN-only TLS certificates.

Replication Peers require hostname verification updates if they meet all three of the following conditions:

  • The peer Cloudera Manager is TLS-enabled (the Peer URL uses https://).

  • The Peer URL uses an IP address instead of a Fully Qualified Domain Name (FQDN).

  • The peer Cloudera Manager TLS certificate is valid only for an FQDN and lacks an IP Subject Alternative Name (SAN).

If a peer matches these conditions, update the canonicalHostname field using the Cloudera Manager REST API:
  1. Locate affected Peers in the Admin Console

    In the target Cloudera Manager UI, navigate to Replication > Peers and identify peers matching the three conditions above.

  2. Retrieve the Peer definition through API
    Execute an HTTP GET request using an account with Admin privileges to retrieve the current peer configuration (for example, peer demo):
    curl -XGET -u admin:admin -k 'https://<target-cm-host>:7183/api/v58/cm/peers/demo'
    Sample response
    {
  "name" : "demo",
  "type" : "REPLICATION",
  "url" : "https://<source-cm-ip-address>:7183",
  "clouderaManagerCreatedUser" : true,
  "enforceSslCheck" : true
}
  3. Update the Canonical Hostname through API
    Execute an HTTP PUT request targeting the /cm/peers/{peerName} endpoint to set the canonicalHostname field to the FQDN specified in the certificate:
    curl -XPUT -u admin:admin -k 'https://<target-cm-host>:7183/api/v58/cm/peers/demo' \
  -H 'Content-Type: application/json' \
  --data-raw '{"canonicalHostname": "<source-cm-fqdn>"}'
    Sample response
    {
  "name" : "demo",
  "type" : "REPLICATION",
  "url" : "https://<source-cm-ip-address>:7183",
  "clouderaManagerCreatedUser" : true,
  "enforceSslCheck" : true,
  "canonicalHostname" : "<source-cm-fqdn>"
}