Cloudera Docs

Enabling TLS/SSL for CMA

Cloudera Migration Assistant uses TLS/SSL to encrypt communication between components. In parcel deployments, Cloudera Manager Auto-TLS provisions certificates automatically.

Cloudera Migration Assistant uses TLS/SSL to encrypt all communication between its components. In parcel deployments, TLS is configured automatically through Cloudera Manager's Auto-TLS feature — no manual steps are needed.

Auto-TLS (default)

When Auto-TLS is enabled in Cloudera Manager, all Cloudera Migration Assistant components (CMA Master, CMA Agent, Gateway, Auth Server) automatically receive keystores, truststores, and certificates provisioned by Cloudera Manager. No additional configuration is required.

gRPC TLS (Master-Agent communication)

Cloudera Migration Assistant encrypts the gRPC channel between the CMA Master and CMA Agents by default. All command dispatch, scan result streaming, and status updates are encrypted in transit.

When no external keystore is configured, the Master auto-generates a self-signed PKCS12 keystore (grpc.p12) at startup and distributes its public certificate to agents via the gateway discovery endpoint. Agents verify the certificate using HMAC-SHA256 signatures keyed to CMA_AGENT_CLIENT_SECRET before importing it into their truststore.

When Auto-TLS is active (Cloudera Manager-managed keystore), keystore generation is skipped and the existing Cloudera Manager keystore is used.

Certificate bootstrap on the agent

On first start, the CSD startup script automatically:

  1. Fetches the gRPC certificate and gateway TLS certificate from GET /api/agent/config

  2. Verifies each certificate's HMAC signature

  3. Imports both into the agent truststore

A guard prevents unnecessary re-download on every restart.

Rotating the gRPC certificate

  1. Set CMA_GRPC_ROTATE_CERT=true in the CMA Master service configuration in Cloudera Manager.

  2. Restart the CMA Master. A new grpc.p12 is generated and the HMAC recomputed.

  3. Restart each CMA Agent. Agents fetch the new certificate and rebuild their truststore.

  4. Remove CMA_GRPC_ROTATE_CERT after the rotation is complete.

TLS configuration parameters

The following parameters are available in the CMA Master service configuration in Cloudera Manager:

Parameter Default Description
Minimum TLS version TLSv1.3 Minimum TLS protocol version for HTTPS connections
TLSv1.2 ciphers See Cloudera Manager defaults Cipher suite preferences for TLS 1.2
TLSv1.3 ciphers See Cloudera Manager defaults Cipher suite preferences for TLS 1.3

Ports

Port Protocol Description
8090 HTTP CMA web UI (redirects to HTTPS when TLS is enabled)
8093 HTTPS CMA web UI (secure)
8891 gRPC + TLS Master-Agent communication