Cloudera Docs

Configuring TLS protocol and overrides for replication peers

This topic details the Transport Layer Security (TLS) version matching, cipher suite compatibility, and peer-specific configuration overrides required to establish secure communication between source and target Cloudera Manager instances.

Replication Peer TLS overview

Understand the fundamental TLS communication requirements for establishing a Replication Peer between Cloudera Manager instances.

All types of replication from a source Cloudera Manager to a target Cloudera Manager require a Replication Peer. You must configure the Replication Peer on the target Cloudera Manager to point to the source Cloudera Manager.

To establish successful TLS communication between two Cloudera Manager instances, your environment must meet specific protocol version, cipher suite, and trust certificate requirements.

TLS Protocol version alignment and overrides

Configure matching TLS protocol versions across source and target instances or apply dedicated peer protocol overrides.

To establish peer communication, both Cloudera Manager instances must support a matching TLS version:
  1. Selecting Global TLS version:
    Configure supported TLS versions in the Cloudera Manger Admin Console:

    1. Log in to the Cloudera Manager UI as an administrator.

    2. Navigate to Administration > Settings.

    3. Type Supported SSL/TLS versions into the configuration search bar.

  2. Replication Peer protocol overrides:
    When you enable CMF_FF_ENCRYPT_ALL_PORTS, you can configure specific TLS versions dedicated exclusively to Replication Peer communication. On the target Cloudera Manager where you define the Replication Peer, navigate to Administration > Settings and search for CM Peer TLS Protocol Override.

    • Default behavior: This setting is empty by default, causing peer communication to fall back to the values configured in Supported SSL/TLS versions.

    • Example values: TLSv1.2, TLSv1.3

TLS Cipher suite compatibility and overrides

Align TLS cipher suites between source and target instances and configure peer-specific cipher overrides.

Both Cloudera Manager instances must agree on a matching TLS cipher suite compatible with the highest mutually supported TLS version:
  1. Source Cloudera Manager Ciphers:

    Configure accepted cipher suites on the source Cloudera Manager host by setting the CMF_OVERRIDE_TLS_CIPHERS environment variable in /etc/default/cloudera-scm-server.

  2. Target Cloudera Manager global Ciphers:

    Configure offered cipher suites on the target Cloudera Manager UI by navigating to Administration > Settings and searching for TLS Cipher List.

  3. Replication Peer Cipher overrides:
    When you enable CMF_FF_ENCRYPT_ALL_PORTS, you can configure specific cipher suites dedicated exclusively to Replication Peer traffic. On the target Cloudera Manager, navigate to Administration > Settings and search for CM Peer TLS Cipher Suite Override.

    • Default behavior: This setting is empty by default, causing peer communication to fall back to the values configured in TLS Cipher List.

    • Example values: TLS_CHACHA20_POLY1305_SHA256, TLS_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Trust certificate requirements

Verify trust certificate relationships and refer to public documentation for exchange procedures.

The target Cloudera Manager must trust the TLS certificate of the source Cloudera Manager. Before you create a Replication Peer, manually export the source Cloudera Manager certificate (or its issuing CA root certificate) and import it into the target Cloudera Manager truststore.

For step-by-step instructions on exchanging and trusting certificates across deployments, see the following guides:

Understanding Replication Peer overrides

The primary purpose of CM Peer TLS Protocol Override and CM Peer TLS Cipher Suite Override is to isolate and modify TLS settings specifically for Cloudera Manager peer communication, leaving global settings intact for all other cluster services.

In enterprise deployments, administrators often manage an older source Cloudera Manager instance that relies on legacy TLS protocols, but they must replicate data to a newer target Cloudera Manager where TLS 1.3 is enforced by default. Applying targeted peer overrides on the target Cloudera Manager keeps the target instance secure while permitting backward-compatible TLS negotiation strictly for replication traffic. This approach eliminates the need to prematurely upgrade the source environment.