Cloudera Docs

Importing self-signed certificates to Java truststore

Import all the self-signed certificates in to the Java truststore using the keytool utility.

To establish a secure, trusted connection for your applications, you must collect all the self-signed certificates of the control plane, Virtual Cluster, Spark Connect, and Cloudera Data Engineering service hostnames and add them to a Java truststore.

  1. Identify the control plane hostname.
    The control plane hostname is the host name present in the URL used to access the on premises control plane. For example, if https://console-cdp.apps.example.cloudera.com is the control plane URL, then console-cdp.apps.example.cloudera.com is the control plane hostname.
  2. Identify the virtual cluster hostname.
    1. Select the Cloudera Data Engineering service containing the virtual cluster that you want to activate.
    2. Click Cluster Details.
    3. Click JOBS API URL to copy the URL to your clipboard.
    4. Paste the URL into a text editor to identify the endpoint host.

      For example, if the copied URL is https://dfdj6kgx.cde-2cdxw5x5.apps.ecs-demo.example.com/dex/api/v1, then the endpoint host is dfdj6kgx.cde-2cdxw5x5.apps.ecs-demo.example.com.

  3. Identify the Spark Connect hostname.
    Prefix sc- to the virtual cluster hostname identified in the previous step. For example, if the virtual cluster hostname is dfdj6kgx.cde-2cdxw5x5.apps.ecs-demo.example.com, then the Spark Connect hostname is sc-dfdj6kgx.cde-2cdxw5x5.apps.ecs-demo.example.com.
  4. Identify the Cloudera Data Engineering service hostname.
    1. Select the Cloudera Data Engineering service containing the virtual cluster that you want to activate.
    2. Click Cluster Details.
    3. Click Grafana Charts to copy the URL to your clipboard.
    4. Paste the URL into a text editor to identify the endpoint host.

      For example, if the copied URL is https://service.cde-2cdxw5x5.apps.ecs-demo.example.com/grafana/249u4dnkfnkdf then the endpoint host is service.cde-2cdxw5x5.apps.ecs-demo.example.com.

  5. Run the following commands to add all the certificates into the Java truststore: 
    openssl s_client -connect [***CONTROL-PLANE-HOSTNAME***]:443 2>/dev/null </dev/null |  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > controlplane.pem
openssl x509 -outform der -in controlplane.pem -out controlplane.der
keytool -import -alias [***CONTROL-PLANE-NAME***] -cacerts -file controlplane.der

openssl s_client -connect [***VIRTUAL-CLUSTER-HOSTNAME***]:443 2>/dev/null </dev/null |  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > vc.pem
openssl x509 -outform der -in vc.pem -out vc.der
keytool -import -alias [***VIRTUAL-CLUSTER-NAME***] -cacerts -file vc.der

openssl s_client -connect [***SPARK-CONNECT-HOSTNAME***]:443 2>/dev/null </dev/null |  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >> cacerts.pem
openssl x509 -outform der -in sc.pem -out sc.der
keytool -import -alias [***SPARK-CONNECT-NAME***] -cacerts -file sc.der

openssl s_client -connect [***CDE-SERVICE-HOSTNAME***]:443 2>/dev/null </dev/null |  sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > service.pem
openssl x509 -outform der -in service.pem -out service.der
keytool -import -alias [***CDE-SERVICE-NAME***] -cacerts -file service.der