Cloudera Docs

Configure Lily HBase Indexer to use TLS/SSL

Although Cloudera recommends using AutoTLS, you also have the option to set up TLS manually for the Lily HBase Indexer.

To configure and enable Hadoop TLS/SSL for the Lily HBase Indexer (Key-Value Store Indexer) perform the following steps.
  1. Open the Cloudera Manager Admin Console and go to the Key-Value Store Indexer.
  2. Click the Configuration tab.
  3. Select Scope > All.
  4. Select Category > All.
  5. In the Search field, type TLS or TLS/SSL to show the HBase Indexer TLS/SSL properties.
  6. Edit the following TLS/SSL properties according to your cluster configuration.

    The Lily HBase Indexer uses the same RPC and server-mode TLS settings as HBase Region Server. For more information about TLS version options, see Configuring the TLS versions for HBase.

    Table 1. Key-Value Store TLS/SSL Properties
    Property Description
    Enable TLS/SSL for HBase-Indexer TLS enable Encrypt communication between clients and the Lily HBase Indexer using Transport Layer Security (TLS) (formerly known as Secure Socket Layer (SSL)).
    Supported SSL/TLS versions The TLS protocol versions to use for HBase Indexer RPC when TLS is enabled. Select TLSv1.2 to enable TLS 1.2 exclusively, TLSv1.3 to enable TLS 1.3 exclusively, TLSv1.2, and TLSv1.3 to enable both versions simultaneously, or Copy From Global Settings to inherit TLS version settings from Cloudera Manager global TLS configuration.
    TLS Cipher List The SSL/TLS cipher suites to use for HBase Indexer RPC. Modern 2018 is a modern set of cipher suites as of 2018, according to the Mozilla server-side TLS recommendations. These cipher suites use strong cryptography and are preferred unless interaction with older clients is required. Intermediate 2018 is an intermediate set of cipher suites as of 2018, according to the Mozilla server-side TLS recommendations. Select Intermediate 2018 if you require compatibility with a wider range of clients, legacy browsers, or older Linux tools.
    HBase Indexer TLS/SSL Certificate Trust Store File The location on disk of the truststore, in .jks format, used to confirm the authenticity of TLS/SSL servers that HBase Indexer might connect to. This is used when HBase Indexer is the client in a TLS/SSL connection. This truststore must contain the certificate(s) used to sign the service(s) being connected to. If this parameter is not provided, the default list of well-known certificate authorities is used instead.
    HBase Indexer TLS/SSL Certificate Trust Store Password (Optional) The password for the HBase Indexer TLS/SSL Certificate Trust Store File. This password is not required to access the truststore: this field can be left blank. This password provides optional integrity checking of the file. The contents of truststores are certificates, and certificates are public information.
  7. Restart the service.