Auto-TLS Requirements and Limitations

Reference information for Auto-TLS requirements, limitations, and component support.


  • You must install the Cloudera Manager Agent software on the Cloudera Manager Server host.
  • You can enable auto-TLS using certificates created and managed by a Cloudera Manager certificate authority (CA), or certificates signed by a trusted public CA or your own internal CA. If you want to use a trusted public CA or your own internal CA, you must obtain all of the host certificates before enabling auto-TLS. For instructions on obtaining certificates from a CA, see “Manually Configuring TLS Encryption for Cloudera Manager”>“On Each Cluster Host”.

Component support for Auto-TLS

  • The following Cloudera Enterprise services support auto-TLS:

    Cloudera Enterprise Components that Support Auto-TLS
    HDFS Client Configuration Impala StateStore
    HDFS NameNode Web UI Kafka Broker Server
    HiveServer2 Cloudera Navigator Audit Server
    HttpFS Cloudera Navigator Metadata Server
    Hue Client Oozie
    Hue Load Balancer Phoenix
    Hue Server Spark History Server
    Impala Catalog Server YARN Web UI

For unlisted Cloudera Enterprise services, you must enable TLS manually. See the applicable component guide for more information.