Configure a Custom Certificate of Authority (Parcel)
If your environment includes a custom Certificate of Authority (CA) that contains custom or non-standard certificates/chains (such as self-signed certificates) that are not included in the set of standard certificates typically included in internet browsers, you must enable Pepperdata to find the CA file.
You can either configure the
SSL_CERT_FILE environment variables or install the custom CA file according to Cloudera’s requirements, which results in a known location/file that Pepperdata can find.
The environment variables take precedence: if you assign them, Pepperdata does not search for the certificates anywhere else, and so will not find them even if you’ve installed them according to Cloudera’s requirements.
Choose the procedure for your preferred approach:
- Assign Environment Variables—makes the CA file available to the Pepperdata services as soon as they start
- Install the Custom CA File per Cloudera Requirements—eliminates a configuration step
Procedure: Assign Environment Variables
Add the environment variables for the locations of the CA bundle and SSL certificate filenames.
Use Cloudera Manager to add the environment variables for the number of history fetcher retries to the Pepperdata > Configuration > PepAgent Environment Advanced Configuration Snippet (Safety Valve) template.
Add the environment variables in the following format.
Be sure to substitute your CA bundle and SSL certificate filenames for the
your-fully-qualified-ssl-cert-fileplaceholders in the following snippet, respectively.
If you set only one of the environment variables, Pepperdata assigns its value to the other environment variable.
REQUESTS_CA_BUNDLEcertificate is used by libraries that use the Python
SSL_CERT_FILEcertificate is used only by libraries that directly use OpenSSL instead of using the Python
export REQUESTS_CA_BUNDLE=your-fully-qualified-ca-bundle-file export SSL_CERT_FILE=your-fully-qualified-ssl-cert-file
Restart the Pepperdata services.
In Cloudera Manager, select the Restart action for the PepAgent service.
Procedure: Install the Custom CA File per Cloudera Requirements
SSL_CERT_FILEenvironment variables unassigned. If you assign them, Pepperdata expects to find the certificates as assigned, and will not look anywhere else.
Consult the Cloudera documentation for how to install your (single) custom CA file in the Cloudera default location for CA files.
The procedure and the default location vary according to your environment’s OS version.
Pepperdata looks in the default locations for all supported OSes, and uses the first CA file that it finds. The locations can be symbolic links whose targets are the actual CA files.