---
title: Configure Hue with HTTPS / SSL
author: admin
type: post
date: 2015-01-16T02:26:14+00:00
url: /configure-hue-with-https-ssl/
sf_thumbnail_type:
- none
sf_thumbnail_link_type:
- link_to_post
sf_detail_type:
- none
sf_page_title:
- 1
sf_page_title_style:
- standard
sf_no_breadcrumbs:
- 1
sf_page_title_bg:
- none
sf_page_title_text_style:
- light
sf_background_image_size:
- cover
sf_social_sharing:
- 1
sf_sidebar_config:
- left-sidebar
sf_left_sidebar:
- Sidebar-2
sf_right_sidebar:
- Sidebar-1
sf_caption_position:
- caption-right
sf_remove_promo_bar:
- 1
slide_template:
- default
categories:
- Administration
---
SSL / HTTPS is often not simple. Here is some light in addition to the [Cloudera Security guide][1] that should help.
## SSL between your browser and Hue
To configure Hue to use HTTPS we need a self signed SSL certificate that does not require a passphrase.
Here is how to generate a private key and a self-signed certificate for the Hue server:
{{< highlight bash >}}openssl genrsa 4096 > server.key
openssl req -new -x509 -nodes -sha1 -key server.key > server.cert
{{< /highlight >}}
**
Note**: answer the questions that follow (complete example below). Entering the hostname for the server is important.
**Note:** you will have to tell your browser to "trust" the self signed server certificate
Then in the Hue configuration in CM or in the [hue.ini][2]:
* Check Enable HTTPS
* Enter path to server.cert in Local Path to SSL Certificate (ssl_certificate)
* Enter path to server.key in Local Path to SSL Private Key (ssl_private_key)
Make sure Hue is setting the [cookie as secure][3].
**Note**: when using a load balanced you might need to set in certain case [secure_proxy_ssl_header][4].
[
][5]
Here is an example of creation of a certificate for enabling SSL:
{{< highlight bash >}}
[root@cehd1 hue]# pwd
/home/hue
[root@cehd1 hue]# ls
cacerts cert key
{{< /highlight >}}
Generate a private key for the server:
{{< highlight bash >}}[root@cehd1 hue]# openssl genrsa -out key/server.key 4096{{< /highlight >}}
Generate a "certificate request" for the server:
{{< highlight bash >}}[root@cehd1 hue] openssl req -new -key key/server.key -out request/server.csr{{< /highlight >}}
You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank. For some fields there will be a default value, if you enter '.', the field will be left blank.
{{< highlight bash >}}Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:Colorado
Locality Name (eg, city) [Default City]:Denver
Organization Name (eg, company) [Default Company Ltd]:Cloudera
Organizational Unit Name (eg, section) []:COE
Common Name (eg, your name or your server's hostname) []:test.lab
Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []: ## note this was left
An optional company name []:
{{< /highlight >}}
Self-sign the request, creating a certificate for the server:
{{< highlight bash >}}[root@cehd1 hue] openssl x509 -req -days 365 -in request/server.csr -signkey key/server.key -out cert/server.crt
Signature ok
subject=/C=US/ST=Colorado/L=
{{< highlight bash >}}keytool -exportcert -keystore hadoop-server.keystore -alias foo-1.cloudera.com \
-storepass cloudera -file foo-1.cert
openssl x509 -inform der -in foo-1.cert > foo-1.pem
{{< /highlight >}}
Once you've done this for each host in the cluster, you can concatenate the .pem files into one .pem file which can serve as the Hue truststore:
{{< highlight bash >}}cat foo-1.pem foo-2.pem ... > huetrust.pem{{< /highlight >}}
After running it, set REQUESTS_CA_BUNDLE in the Hue environment safety valve to /etc/hadoop/ssl-conf/huetrust.pem
Here is an interesting link if you want to read more about generating SSL certificates.
As usual feel free to comment and send feedback on the hue-user list or @gethue!