Auto-TLS Requirements and Limitations
Reference information for Auto-TLS requirements, limitations, and component support.
- You must install the Cloudera Manager Agent software on the Cloudera Manager Server host.
- You can enable auto-TLS using certificates created and managed by a Cloudera
Manager certificate authority (CA), or certificates signed by a trusted
public CA or your own internal CA. If you want to use a trusted public CA or
your own internal CA, you must obtain all of the host certificates before
enabling auto-TLS. For instructions on obtaining certificates from a CA, see
Manually Configuring TLS Encryption for Cloudera Manager>
On Each Cluster Host.
Component support for Auto-TLS
The following CDP services support auto-TLS:
- Cloudera Manager Host Monitor Debug Interface
- Cloudera Manager Service Monitor Debug Interface
- Cruise Control
- HDFS Client Configuration
- HDFS NameNode Web UI
- Hue Client
- Hue Load Balancer
- Hue Server
- Impala Catalog Server
- Impala Server
- Impala StateStore
- Java Keystore Key Management Server (KMS)
- Kafka Broker Server
- Kafka Mirrormaker
- Safenet Luna Hardware Security Modules (HSM) KMS
- Schema Registry
- Spark History Server
- Streams Messaging Manager
- Streams Replication Manager
- YARN Web UI
For unlisted CDP services, you must enable TLS manually. See the applicable component guide for more information.
- It is not possible to rename hostnames of cluster nodes in an Auto-TLS setup.