Hello @IgorYakushin,   Cloudera's documentation does have some basic background here: https://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_guide_ssl_certs.html https://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_create_key_trust.html   For Cloudera Manager / Agent encryption: https://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_config_tls_security.html   To your specific questions:   (1)   my.truststore or jssecacerts?   By default, the JDKs ships with a file that contains common public CA certificates for trust: $JAVA_HOME/jre/lib/cacerts Java will look to that file if it is not told (in a program or via command line) to use another file. If there is a $JAVA_HOME/jre/lib/jssecacerts file present, that file will be read instead of the "cacerts" file there.   If you want to use my.truststore (your custom file) then you would need to let the JVM know to use that file.  Cloudera Manager should have configuration options form most Java Keystores, so that is one way to tell the JVM where to find the truststore.  See this section of the JSSE reference for more information about the truststore:   http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#X509TrustManager   Basically,   1. if CM (Cloudera Manager)'s truststore configuration for a service or role is specified, that will be used. 2. If none is specified, java will use "javax.net.ssl.trustStore" if it is set (at the command line, for instance) 3. If "javax.net.ssl.trustStore" is not set, then$JAVA_HOME/jre/lib/jssecacerts is used 4. If $JAVA_HOME/jre/lib/jssecacerts does not exist, then the default $JAVA_HOME/jre/lib/cacerts is used.   When securing Cloudera Manager/Agent communication (I assume that is what you meant by levels 1-3):   1. no truststore is required for level 1 (TLS enabled, no certificate validation) 2. only openssl trust store is required for level 2 (TLS enabled, agent needs trust for the Cloudera Manager server certificate signer 3. Both of the above are required, and Cloudera Manager needs to be configured to read a truststore containing all the agents' public certificates. (CM validates the agents' certificates)   I don't have a really good beginners guide to the topics handy at the moment, but you'll find some reasonable information here:   https://en.wikipedia.org/wiki/Transport_Layer_Security       ... View more

@guruprasadc11,   The requirements for a valid parcel that can be recognized by Cloudera Manager is that the parcel file and accompanying "manifest.json" file be located in the same directory.  What do you have in your cdh-5.10.0 directory on the local repo HTTP server?   Make sure that the files there are accessible, too, and that permissions are not preventing listing/download.   For more information regarding your CDH repository and parcel, tail -f /var/log/cloudera-scm-server/cloudera-scm-server.log while adding your URL to the list of parcel repositories in the wizard.   Cheers,   Ben ... View more