Cloudera Docs

Updating the Control Plane certificates in Cloudera Data Engineering services

Learn about how to update the Control Plane certificates in Cloudera Data Engineering services.

When you create a Cloudera Data Engineering service, Cloudera Data Engineering automatically installs a self-signed TLS certificate. Do the following steps to update the TLS certificate for Cloudera Data Engineering services:

  1. In the Cloudera console, click the Data Engineering tile. The Cloudera Data Engineering Home page displays.
  2. Click Administration in the left navigation menu. The Administration page displays.
  3. In the Services column, select the service for which you want to you want to update the TLS certificate and click Service Details.
  4. Click on GRAFANA CHARTS and get the domain name.
  5. Paste the URL into a text editor to identify the service domain.. For example, if the URL copied is https://service.cde-2cdxw5x5.apps.ecs-demo.example.com/grafana/d/sK1XDusZz/kubernetes, The service domain is https://service.cde-2cdxw5x5.apps.ecs-demo.example.com.
  6. Create your CA certificate and private key. Make sure that your CA certificate includes the Subject Alternative Names (SAN) for all relevant endpoints.
    • CN (Common Name): *.cde-2cdxw5x5.apps.ecs-demo.example.com
    • Domain name for the Service: service.cde-2cdxw5x5.apps.ecs-demo.example.com
  7. Sign in to Cloudera Data Engineering as Service Admin. The Cloudera Data Engineering Home page displays.
  8. Click Administration in the left navigation menu. The Administration page displays.
  9. In the Services column, select the service for which you want to you want to update the TLS certificate and click Service Details.
  10. Click TLS Certificate.
  11. Click Upload Certificate.
  12. Under PEM file, click Select File and select your TLS certificate.
  13. Under Key file, click Select File and select your key file.
  14. (Optional) If your key file is encrypted with a password, then enter the password in the Passphrase field.
  15. Click Install Certificate.
  16. Repeat the steps for all the relevant Services.
  1. Make sure that you are using the ServiceAdmin role and rotate Service level TLS Certificate.
    curl -H "Cookie: cdp-session-token=${CST}" \  '[***BASE-URL***]/dex/api/v1/cluster/<cluster-id>/tls' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -X 'PUT' -d '{
certificate_details": {
"certificate": "base64 encoded.pem-file content",
"key": "<base64 encoded file content>",
"passphrase": "<base64 encoded passphrase for the key>" (optional) 
      }
}'
  2. Make sure that you are using at least a ServiceUser role and view Service level TLS Certificate information.
    curl -H "Cookie: cdp-session-token=${CST}" \  '[***BASE-URL***]/dex/api/v1/cluster/<cluster-id>/tls' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -X GET -d '{}'