cloudera agent TLS configuration

Question

Hello.I'm trying to use my own certs from CA(I converted them to right format)I'm already configurated TLS for cloudera manager server (when I signed on https://{MASTER_IP}:7183 - I see it.File cm_init.txt setsettings AGENT_TLS truesetsettings WEB_TLS truesetsettings NEED_AGENTS_VALIDATION truesetsettings AUTO_TLS_TYPE NONEsetsettings KEYSTORE_PATH /opt/agentcerts/MYKEYSTORE.jkssetsettings KEYSTORE_PASSWORD MYPASSWORDsetsettings TRUSTSTORE_PATH /opt/agentcerts/MYTRUSTSTORE.jkssetsettings TRUSTSTORE_PASSWORD MYPASSWORDAlso I used them for HUE web UI and Hue Load Balancer - its also work too.But, I need to configurate certs to agents too, because I didn't see status of my agents in (hosts ->all hosts tab).I changed file /etc/cloudera-scm-agent/config.ini, there main changes on him: use_tls=1verify_cert_file=/opt/agentcerts/MYCERT.pemclient_key_file=/opt/agentcerts/MYKEY.pemclient_keypw_file=/opt/agentcerts/KEYPASS.pwclient_cert_file=/opt/agentcerts/MYCERT.pemverify_cert_dir=/opt/agentcerts/ But in log file /var/log/cloudera-scm-agent/cloudera-scm-agent.log I still see defaults conf while it starts: [14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO     Agent Logging Level: INFO[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO     Agent config:[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO      Security.max_cert_depth = 9[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO      Security.use_tls = 0[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO      Security.client_cert_file = /var/lib/cloudera-scm-agent/agent-cert/cm-auto-host_cert_chain.pem[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO      Security.verify_cert_file = /var/lib/cloudera-scm-agent/agent-cert/cm-auto-in_cluster_ca_cert.pem[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO      Security.client_key_file = /var/lib/cloudera-scm-agent/agent-cert/cm-auto-host_key.pem[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO      Security.client_keypw_file = /var/lib/cloudera-scm-agent/agent-cert/cm-auto-host_key.pw[14/Sep/2020 14:09:36 +0000] 2560 MainThread agent        INFO      Security.cm_auto_cert_dir = /var/lib/cloudera-scm-agent/agent-cert Especially Idk why in log I see what use_tls=0.

Yuriy_but · Accepted Answer

Miracle!It's start work while I delete file "config.ini.orig" from folder /etc/cloudera-scm/agent/Now there only "config.ini" file.

Bender · Answer

Hello @Yuriy_but ,

thank you for reaching out to the Community. What is the CDH version you are using, please?

For CDH6.3 please find here the related documentation on how to manually configure TLS Encryption for CM.

Did you follow the steps from the documentation, please?

Thank you:
Ferenc

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.