Enable TLS/SSL Encryption for Cloudera Manager Admin Console

This step ensures that browsers connecting the Cloudera Manager Admin Console use the HTTPS port (7183) and encrypts communications between the browser and the server.

1. Log in to the Cloudera Manager Admin Console.
2. Select Administration > Settings.
3. Select the Security category.
4. Scroll through the settings to the section for TLS encryption settings and enter values for the following:

   Property	Description
   Use TLS Encryption for Admin Console	Check the box to enable TLS encryption for Cloudera Manager.
   Cloudera Manager TLS/SSL Server JKS Keystore File Location	Enter the complete path to the keystore created in Step 3: Generate Server Key and CSR. Replace the example path and filename with your own settings. The example path with example filename are as follows: /opt/cloudera/security/pki/cmsrv.example.com.jks
   Cloudera Manager TLS/SSL Server JKS Keystore File Password	Enter the password for the keystore.

5. Click Save Changes to save the settings.

While still logged in to the Cloudera Manager Admin Console:

1. Select Clusters > Cloudera Management Service.
2. Click the Configuration tab.
3. Select Scope > Cloudera Management Service (Service-Wide).
4. Select Category > Security.
5. Enter values for the following TLS/SSL properties:

   Property	Description
   TLS/SSL Client Truststore File Location	The path to the client truststore file used in HTTPS communication. This truststore contains certificates of trusted servers, or of Certificate Authorities trusted to identify servers. For this example, set the value to: $JAVA_HOME/jre/lib/security/jssecacerts Replace $JAVA_HOME with the path to the Oracle JDK.
   Cloudera Manager Server TLS/SSL Certificate Trust Store Password	The password for the truststore file.

6. Click Save Changes to save the settings.

You must restart both Cloudera Manager Server and the Cloudera Management Service for the system to implement these changes, and to enable the Cloudera Management Service roles (Host Monitor, Service Monitor, and so on) to communicate with Cloudera Manager Server.

1. Restart the Cloudera Manager Server by running service cloudera-scm-server restart on the Cloudera Manager Server host.
2. After the restart completes, connect to the Cloudera Manager Admin Console:

   https://cm01.example.com:7183

For server certificates signed by an internal CA, configure the browser to explicitly trust the certificate, to avoid seeing the warning prompt each time you connect to Cloudera Manager Admin Console.