Enabling TLS 1.3 and Customizing Cipher Suites in Cloudera Manager

Enabling TLS 1.3 using the Cloudera Manager Admin Console

Use the Cloudera Manager UI to configure and select active cluster TLS versions.

Navigate to SSL/TLS settings:
1. Log in to the Cloudera Manager UI as an administrator.
2. Navigate to Administration > Settings.
3. Type Supported SSL/TLS versions into the configuration search bar.
Set the target TLS versions:
Select your preferred configuration from the property dropdown menu:
1. Choose TLSv1.3 to enable TLS 1.3 exclusively.
2. Choose TLSv1.2, and TLSv1.3 to enable both versions simultaneously.
3. Choose TLSv1.2 to enable TLS 1.2 exclusively.
Save changes and restart the Cloudera Manager:
1. Click Save Changes.
2. Log in to your terminal host and restart Cloudera Manager Server through SSH:
```
sudo systemctl restart cloudera-scm-server
```
Verify Log output:
1. Run the following search against the server log directory to confirm success:
```
cat /var/log/cloudera-scm-server/cloudera-scm-server.log | grep "Configured TLS versions"
```

Configuring Service Cipher Suites

Use the Cloudera Manager UI to edit the global cipher distribution list and manage cluster component inheritance behaviors.

important

Service Configuration: Cloudera Manager passes the ciphers within Administration > Settings to the cluster services instead of running them on the Cloudera Manager Server itself. Services use these ciphers when their TLS cipher parameter contains Copy From Global Settings (stored internally as {{COPY_FROM_GLOBAL}}).
Protocol Alignment: Services operate through their specific TLS version, which by default mirrors the global configuration on the Cloudera Manager Administration > Settings page. Therefore, you must verify that the TLS ciphers in the global configuration match the active TLS version. If necessary, you can add specific ciphers into individual services to override the global options.
Service-Specific Ciphers: You can customize the cipher list for individual services through the TLS options on that specific service configuration page.
Java Format Requirements: Ensure you enter the ciphers in the correct Java syntax format (for example, TLS_AES_256_GCM_SHA384). Formatting errors can cause unexpected behavior or complete system failures.

Navigate to Cloudera Manager Global TLS Cipher List Settings:
1. Log in to the Cloudera Manager UI as an administrator.
2. Navigate to Administration > Settings.
3. Type TLS Cipher List into the search input.
Edit the Cloudera Manager Global TLS Cipher List:
1. The text box shows the current cipher list. Cloudera Manager supplies this list to services, which use it to establish their cipher configurations.
  
  Modify the list to include your preferred cipher suites. Ensure you type the ciphers in the correct format (for example, TLS_AES_256_GCM_SHA384), which complies with the Java-based TLS Cipher format.
  
  By default, the list contains:
```
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
```
Click Save Changes.
Restart all services that use the Global TLS Cipher Suite, as the configuration change makes their current status stale.

Cloudera Manager Server Default TLS Ciphers

By default, the Cloudera Manager Server uses a predefined set of hardcoded TLS ciphers to secure communications. To meet specific organizational security policies or compliance standards, administrators can override these default ciphers by defining a custom cipher list using the CMF_OVERRIDE_TLS_CIPHERS environment variable in the /etc/default/cloudera-scm-server configuration file.

Once you enable the required feature flags, the server activates the supported TLS 1.2 and TLS 1.3 cipher suites.

Active Cipher Suites

Upon enabling the required feature flags, Cloudera Manager Server activates the following cipher suites:

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Overriding Cloudera Manager Server TLS Ciphers

This section describes how administrators can override the hardcoded default ciphers by defining a custom cipher list in the Cloudera Manager Server configuration file to meet specific security or compliance requirements.

To choose custom TLS ciphers for the Cloudera Manager Server, edit the server configuration file:
```
/etc/default/cloudera-scm-server
```
Add your custom ciphers using the Java format (replace the placeholder text with your choice of ciphers):
```
export CMF_OVERRIDE_TLS_CIPHERS="TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
```
important
This setting overrides ciphers for the Cloudera Manager Server only. To override ciphers for cluster services, configure the TLS cipher options on each service’s configuration page in the Cloudera Manager UI.
Restart the Cloudera Manager Server to apply the changes:
```
sudo systemctl restart cloudera-scm-server
```

Configuring TLS Protocol Versions and Ciphers for Cloudera Manager Agents

Administrators can enforce specific TLS protocols and ciphers on individual host agents by modifying the local Agent configuration file. Explicit values configured in this file take precedence over server defaults.

Agent Security Settings

Configure the TLS parameters under the [Security] section of /etc/cloudera-scm-agent/config.ini on each host:


Setting Parameter	Description
`minimum_tls_protocol`	Specifies the lowest TLS/SSL protocol version the Agent negotiates.
`cipher_list`	Defines the OpenSSL cipher list the Agent offers and accepts.
`server_cipher_list`	Specifies the OpenSSL cipher list for the Agent's status server (a stricter variant of `cipher_list`).

Steps

Edit /etc/cloudera-scm-agent/config.ini on the target host, uncomment the parameters under the [Security] section, and set your desired values:
```
[Security]
minimum_tls_protocol=TLSv1.3
cipher_list=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
server_cipher_list=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
```
important
You can override any subset of these parameters. For example, setting only minimum_tls_protocol leaves cipher list management to the server.
Restart the Cloudera Manager Agent to apply the change:
```
sudo systemctl restart cloudera-scm-agent
```

These steps allow you to enable TLS 1.3 for Cloudera Manager with the correct ciphers for your services. This process ensures enhanced security for all encrypted communications across your network.