Cloudera Manager 와 에이전트에 TLS 를 수동으로 거는 절차의 준비 단계. 전체 절차는 공식 문서를 따른다.[1]
Cloudera 가 권장하는 경로는 /opt/cloudera/security/pki 다. 전 노드에 같은 경로를 쓴다.
mkdir -p /opt/cloudera/security/pki
chown -R cloudera-scm:cloudera-scm /opt/cloudera/security/pki
chmod 755 /opt/cloudera/security/pki
JDK 11 · 17 은 $JAVA_HOME/lib/security, JDK 8 은 $JAVA_HOME/jre/lib/security 다.
# JDK 11 / 17
cp $JAVA_HOME/lib/security/cacerts $JAVA_HOME/lib/security/jssecacerts
# JDK 8
cp $JAVA_HOME/jre/lib/security/cacerts $JAVA_HOME/jre/lib/security/jssecacerts
cd /opt/cloudera/security/pki
openssl pkcs12 -export -name $(hostname -f) -in $(hostname -f).crt -inkey $(hostname -f).key -out $(hostname -f).p12
keytool -importkeystore -destkeystore $(hostname -f).jks -srckeystore $(hostname -f).p12 -srcstoretype pkcs12 -alias $(hostname -f)
ln -s /opt/cloudera/security/pki/$(hostname -f).jks /opt/cloudera/security/pki/server.jks
Administration › Settings › Security
| 설정 | 값 |
|---|---|
| Cloudera Manager TLS/SSL Server JKS Keystore File Location | /opt/cloudera/security/pki/server.jks |
| Cloudera Manager TLS/SSL Server JKS Keystore File Password | 키스토어 비밀번호 |
| Use TLS Encryption for Admin Console | 체크 |
에이전트는 /etc/cloudera-scm-agent/config.ini 의 [Security] 절:
use_tls=1
verify_cert_file=/opt/cloudera/security/pki/rootca.pem
client_cert_file=/opt/cloudera/security/pki/agent.pem
client_key_file=/opt/cloudera/security/pki/agent.key
client_keypw_file=/etc/cloudera-scm-agent/agentkey.pw
systemctl restart cloudera-scm-server
systemctl restart cloudera-scm-agent
Manually Configuring TLS Encryption for Cloudera Manager (7.3.1). 2026-09-17 확인. https://docs.cloudera.com/cdp-private-cloud-base/7.3.1/security-encrypting-data-in-transit/topics/cm-security-how-to-configure-cm-tls.html ↩︎