Enforcing TLS version for Cloudera Data Explorer (Hue)

Data Explorer communicates by using TLS version 1.2 or higher as the default protocol. You can enforce a minimum TLS version of 1.2 by setting the SSL protocol property in Cloudera Manager.

To use TLS version 1.3, ensure that your environment meets the following requirements:

Python 3.11 or higher
OpenSSL 3.5.5 or higher

When you enable the feature flag, Cloudera Manager supports the following TLS versions:

TLSv1.2 – Enables TLS 1.2 exclusively.
TLSv1.3 – Enables TLS 1.3 exclusively.
TLSv1.2 and TLSv1.3 (Default) – Enables both TLS 1.2 and TLS 1.3 simultaneously.

Sign in to Cloudera Manager as an Administrator.
Go to Clusters > service > Configuration > Load Balancers > Advanced and add the following line in the SSL Protocol field:
```
+TLSv1.2 +TLSv1.3
```
Click Save Changes.
Restart the Data Explorer service.

Verify that TLS version 1.2 and TLS version 1.3 are used for encryption and that all configured ciphers are strong by using a security scanner such as Nmap.

Open a CLI console on a machine in your cluster.

Run the following command:

nmap -sV --script ssl-enum-ciphers -p 8889 [***HOSTNAME***] -f

Replace [***HOSTNAME***] with the actual name of the host.

The following sample output shows the ciphers available for the handshake and indicates that all configured ciphers are rated strong (A):

Starting Nmap 7.92 ( https://nmap.org ) at 2026-08-19 22:21 PDT
Nmap scan report for hostname.example.com (a.b.c.d)
Host is up (0.000046s latency).
PORT     STATE SERVICE VERSION
8889/tcp open  http    Apache httpd 2.4.62 ((Red Hat Enterprise Linux) OpenSSL/3.5.5)
|_http-server-header: Apache/2.4.62 (Red Hat Enterprise Linux) OpenSSL/3.5.5
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 3072) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 3072) - A
|     compressors: 
|       NULL
|     cipher preference: server
|   TLSv1.3: 
|     ciphers: 
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_128_CCM_SHA256 (ecdh_x25519) - A
|     cipher preference: server
|_  least strength: A

To restrict active cipher suites to secure connections using the Data Explorer advanced configuration settings.
1. Sign in to Cloudera Manager as an Administrator.
2. Go to Clusters > service > Configuration > Hue Server and specify the following in the Hue Server Advanced Configuration Snippet (Safety Valve) for hue_safety_valve_server.ini field:
```
[desktop]
ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2:!SSLv3:!TLSv1
```
  The SSL_CIPHER_LIST property is a list of one or more cipher suite strings separated by colons. This restricts the use of the default cipher suite before establishing an encrypted SSL connection.
3. Click Save Changes.
4. Restart the Data Explorer service.