Acceldata
 ODP
Search documentation… ⌘K

Configure SSL for Hue Using a PKCS12 Certificate on ODP

This article explains how to enable SSL for Hue using a PKCS12 (.p12) certificate file.

Use this procedure when Hue is accessible over HTTP and you want to enable HTTPS access.

Symptoms

After enabling SSL, Hue may fail to start or HTTPS access may not work.

Common causes include:

  • Incorrect certificate configuration
  • Missing certificate chain
  • Invalid private key permissions
  • Missing SSL password configuration

Prerequisites

Ensure you have:

  • A valid PKCS12 certificate file (.p12)
  • The certificate password
  • Access to the Hue host

Extract the Certificate Files

Extract the private key

openssl pkcs12 \
-in /etc/hue/ssl/hue.p12 \
-nocerts -nodes \
-out /etc/hue/ssl/server.key
Set permissions:

chmod 400 /etc/hue/ssl/server.key

Extract the server certificate

openssl pkcs12 \
-in /etc/hue/ssl/hue.p12 \
-clcerts -nokeys \
-out /etc/hue/ssl/server.crt
Set permissions:

chmod 644 /etc/hue/ssl/server.crt

Extract the certificate chain

openssl pkcs12 \
-in /etc/hue/ssl/hue.p12 \
-cacerts -nokeys -chain \
-out /etc/hue/ssl/chain.pem
Set permissions:

chmod 644 /etc/hue/ssl/chain.pem

Create the Full Certificate Chain

Combine the server certificate and certificate chain:

cat /etc/hue/ssl/server.crt \
/etc/hue/ssl/chain.pem \
> /etc/hue/ssl/fullchain.crt
Set permissions:

chmod 644 /etc/hue/ssl/fullchain.crt

Configure Hue SSL

Update the Hue SSL settings:

ssl_certificate={{desktop_ssl_certificate}}
ssl_private_key={{desktop_ssl_private_key}}
ssl_certificate_chain={{desktop_ssl_certificate_chain}}
ssl_password_script={{desktop_ssl_password_script}}
Configure the corresponding values in Ambari.

Set File Ownership

chown -R hue:hue /opt/certs
chmod 750 /opt/certs
Ensure:

server.key 400
server.crt 644
chain.pem 644
fullchain.crt 644

Verify the Certificate

Verify the private key

openssl rsa -in server.key -check -noout

Verify the key matches the certificate

openssl x509 -noout -modulus -in server.crt | openssl md5
openssl rsa -noout -modulus -in server.key | openssl md5
Both values should match.

Verify the certificate chain

openssl verify -CAfile chain.pem fullchain.crt
Expected output:

fullchain.crt: OK

Configure the SSL Password

If the private key is password protected:

  1. Configure the Hue SSL password in Ambari.
  2. Use the same password that was used to protect the private key.

Restart Hue

Restart the Hue service from Ambari.

After the restart completes, access Hue using:

https://<hue-host>:8888

Validation

Verify:

  • Hue starts successfully.
  • HTTPS access works.
  • Browser certificate warnings are not present.
  • HDFS File Browser loads successfully.

Summary

To enable SSL for Hue:

  1. Extract the private key, server certificate, and certificate chain from the PKCS12 file.
  2. Create a full certificate chain file.
  3. Configure the SSL properties in Hue.
  4. Set correct file ownership and permissions.
  5. Configure the SSL password if the key is encrypted.
  6. Restart Hue and validate HTTPS access.

This procedure resolves most SSL enablement issues for Hue deployments using PKCS12 certificates.