Transport Layer Security Support and Custom Protocol Configuration

Cloudera Base on premises 7.3.2 SP1 (7.3.2.10000) release introduces the ability to enable Transport Layer Security (TLS) version 1.3 across cluster components and services using Cloudera Manager 7.13.2.10000. This topic outlines how to enable advanced TLS version controls and universal port encryption through feature flags, manage supported protocol versions, configure cryptographic cipher suites, and understand system limitations.

System Requirements and Deployment Limitations

Review the mandatory Java runtime requirements and architectural constraints before attempting to enable TLS 1.3.

Minimum Java Requirement: TLS 1.3 is strictly supported only on environments running Java 17.0.11 or higher. Ensure your cluster JDK meets this baseline before changing configuration parameters to enable this protocol.
Minimum Python Requirement: TLS 1.3 requires Python 3.11 or higher. You must ensure the host environment meets this baseline version before configuring the protocol.
Service Pack Dependency: You must upgrade your cluster to Cloudera Runtime 7.3.2 SP1 and Cloudera Manager to version 7.13.2.10000 or higher to access and enable these features.
Global Cipher List Limitations: Cloudera Manager distributes and applies the global TLS Cipher List configuration (defined in the Cloudera Manager UI) to Cloudera Runtime cluster components only. Cloudera Manager itself ignores this global setting. To enable or modify the active ciphers for Cloudera Manager Server, you must manually edit its local environment file (/etc/default/cloudera-scm-server).

Prerequisites

Enabling Advanced TLS and Encryption Feature Flags

Make the advanced configuration parameters visible in the Cloudera Manager User Interface and API by enabling backend feature flags.

Cloudera Manager hides the advanced TLS version controls (TLS 1.2, TLS 1.3) and global cipher configurations by default. You must enable the following two feature flags inside the Cloudera Manager Server configuration file to access them:

CMF_FF_TLS_ADVANCED_CONTROL: Enables advanced TLS version selection (TLS 1.2, TLS 1.3), global cipher suite distribution, and the per-component cipher inheritance option.
CMF_FF_ENCRYPT_ALL_PORTS: Enables TLS encryption enforcement on internal service ports that were previously unencrypted, providing comprehensive end-to-end encryption across all cluster nodes.

Log in to your Cloudera Manager Server host through SSH and open the /etc/default/cloudera-scm-server configuration file in a text editor:
```
sudo vi /etc/default/cloudera-scm-server
```

Append the following environment variables to the file:

export CMF_FF_TLS_ADVANCED_CONTROL=true
export CMF_FF_ENCRYPT_ALL_PORTS=true

Save the file and restart the Cloudera Manager Server daemon to apply the flags:
```
sudo systemctl restart cloudera-scm-server
```

Protocol Control and Cipher Inheritance Behaviors

Understand the UI properties and functional behaviors that take effect once you enable the advanced TLS control flags in Cloudera Manager.

Enabling CMF_FF_TLS_ADVANCED_CONTROL allows you to:

Select Protocols: You can now enable TLSv1.2, TLSv1.3, or a combined fallback option of TLSv1.2 and TLSv1.3 (Default) through the UI or API.
Enable Global Cipher Management: A new TLS Cipher List setting appears under Administration > Settings. Enabling a cipher suite here automatically pushes the policy to all managed cluster services.
Enable Uniform Policy Inheritance: When you enable advanced TLS controls, individual service configuration pages can use the Copy From Global Settings option (stored internally as {{COPY_FROM_GLOBAL}}) so a component inherits the global TLS version or cipher policy. CSD services use this inheritance model by default starting with Cloudera Manager 7.13.2.10000; see Enabling TLS 1.3 and Customizing Cipher Suites in Cloudera Manager for cipher configuration details.

Enabling CMF_FF_ENCRYPT_ALL_PORTS allows you to:

Enable Universal Port Encryption: This forces TLS over all internal inter-service communication channels.
caution
You must verify that all cluster services are fully configured for TLS before enabling this flag in environments that previously operated without encryption. Ensure you provision and configure valid TLS certificates and truststores for those services prior to a restart, otherwise the cluster startup will fail.

Supported and Deprecated TLS Protocol Matrix

Review the active protocol options available when you activate advanced controls. Enabling these advanced control flags restricts the protocol configuration matrix, causing Cloudera Manager to drop insecure legacy protocols and prevent you from enabling them.

Supported TLS Protocol Options (Available to Enable):

When you enable the feature flag, Cloudera Manager supports the following TLS versions:

TLSv1.2
TLSv1.3
TLSv1.2 and TLSv1.3 (Default)

Removed Legacy Protocol Configurations (Unsupported):

Additionally, starting with Cloudera Manager 7.13.2.10000, Cloudera Manager drops support for the following protocol combinations when you enable the feature flag:

SSLv2Hello, TLSv1, TLSv1.1, and TLSv1.2
SSLv2Hello, TLSv1.1, and TLSv1.2
SSLv2Hello, and TLSv1.2

Reverting Feature Flag Settings

Review the rollback behavior and learn how Cloudera Manager manages active cluster encryption policies when you remove feature flags.

When you disable or remove feature flags in /etc/default/cloudera-scm-server, Cloudera Manager automatically reverts its primary communication protocol to TLSv1.2.

Once you turn off the feature flag, managed cluster components and services ignore global UI settings and automatically return to their previous configuration states.