Configure TLS/SSL for the database on the cloud provider side.

External database: Enforce TLS/SSL on the database using the cloud provider console. Use the provider CA bundle or enterprise CA per policy. For more information about how to enforce TLS/SSL for your cloud provider infrastructure, see the AWS, Azure and GCP documentation.
The CA bundles for the cloud providers can be downloaded from AWS, Azure or GCP.
note
These repositories apply to public endpoints provided by the cloud provider (such as API endpoints, managed load balancers, database instances like RDS/Cloud SQL, etc.). If you provision internal private CAs (for example using AWS Private CA or GCP CA Service), those certificates are generated within your account and are not listed in these public directories.
Embedded / host database: Enforce hostssl / pg_hba.conf and server certificate per your operating system and Cloudera version. To generate certificates using Cloudera Manager API, see the Certmanager Options - Using Cloudera Manager's GenerateCMCA API documentation. The pg_hba.conf file is under /dbfs/pgsql/data/.
note
FreeIPA is only involved for embedded-DB trust when that stack (or parent datalake) uses embedded Postgres with SSL enabled. You can trigger the update command by using the CDP CLI commands below.
```
cdp datahub rotate-secrets --datahub <CRN> --secret-types "EMBEDDED_DB_SSL_CERT"
```
If the rotate-secrets command fails, try updating the salt state with the following command and then run the rotate-secrets command again:
```
cdp datahub update-orchestrator-state --cluster-crn <value>
```
Update the pg_hba.conf file with the following lines. For an external database, cloud provider certificate is used for SSL communication.
```
1ihostnossl all all ::0/0 reject
1ihostnossl all all 0.0.0.0/0 reject

The first line rejects all unencrypted (non-SSL) IPV6 connection attempts.
The second line does the same for IPV4.
```

Configure the database connection in Cloudera Manager.

You need to edit the db.properties (or automation-generated equivalent) on the Cloudera Manager node after the database accepts the TLS/SSL connections. The db.properties files should be located under /etc/cloudera-scm-server/. The following example shows what the db.properties file should look like:
```
com.cloudera.cmf.db.type=postgresql
com.cloudera.cmf.db.host=***.wl.cloudera.site
com.cloudera.cmf.db.name=***
com.cloudera.cmf.db.user=***
com.cloudera.cmf.db.setupType=EXTERNAL
com.cloudera.cmf.db.password=***
com.cloudera.cmf.orm.hibernate.connection.url=jdbc:postgresql://***.cloudera.site/clouderamanager?sslmode=verify-full&sslrootcert=/hadoopfs/fs1/database-cacerts/certs.pem
```

Create the /hadoopfs/fs1/database-cacerts/certs.pem bundle.

This file is a PEM bundle of the CA certificate(s) that signs your external database’s TLS certificate. Build it before enabling manual DB TLS:

Obtain the CA bundle for your database (cloud provider bundle or enterprise CA).
Ensure each cert is PEM (-----BEGIN CERTIFICATE----- … -----END CERTIFICATE-----).
Concatenate root and any required intermediate CAs into a single file named certs.pem.
On each cluster host that connects to the database, create /hadoopfs/fs1/database-cacerts/ and copy certs.pem there.
Confirm connectivity with sslmode=verify-ca or verify-full using that path as sslrootcert.

Examples for CA certificates:

AWS RDS: use the regional or global RDS CA bundle.
Azure PostgreSQL: combine Microsoft RSA Root CA 2017 and DigiCert Global Root G2.
GCP Cloud SQL: use the instance or regional Cloud SQL CA bundle from Google.

Update the Cloudera Manager configuration.

Update the Cloudera Manager database configuration and Hive MetaStore database configuration so JDBC URLs include SSL/TLS (sslmode, trust store, path to CA as supported by your Cloudera Manager version).
Restart or rolling restart of Cloudera Manager and dependent services as required.

Update the Control Plane configuration.

The Control Plane database and stack metadata (ssl flags, cluster DB SSL enabled, and the CA bundle) must stay synchronized with Cloudera Manager and the cloud database. Updating the Control Plane configurations must be handled by the Cloudera support team. Open a support ticket to assist you in the Control Plane configuration for the TLS/SSL connection.

Restart the database when required.

SSL enforcement may require a database instance restart based on the provider. Plan downtime and order of operations:
Cloudera Data Hub or Data Lake down means that Cloudera Manager is down. With Cloudera Manager down, the database change can be completed. After the database is updated, the database might need to be restarted. After the database is restarted with the updates, Cloudera Manager needs to be configured. After the configuration, Cloudera Manager can start up and the Data Lake and Cloudera Data Hub services can be updated. With the updated services, Data Lake and Cloudera Data Hub can be restarted.

Validate the TLS/SSL connection.

From Cloudera Manager, access the Service Monitor and ensure that the connection is without errors.

Use psql or other tools to confirm only SSL is accepted if you enforce strict mode. Verify using the following command that you are able to connect to the database:

For External Database:
psql "host=your-db-instance port=5432 dbname=DB_NAME user=DB_USER sslmode=verify-full sslrootcert=/hadoopfs/fs*/database-cacerts/certs.pem"

For Embedded Database:
psql "host=localhost port=5432 dbname=DB_NAME user=DB_USER sslmode=verify-ca sslrootcert=/hadoopfs/fs*/database-cacerts/certs.pem"

Option 2: Manually enable database TLS/SSL for existing clusters