Configure Azure Endpoint SSL Properties in Ranger

Configure Ranger to trust the Azure storage endpoint certificate.

Import the Azure Certificate

Create a directory for the certificates:

mkdir -p .azure-certs
cd .azure-certs

Retrieve the Azure certificate chain:

echo | openssl s_client \
  -connect <storage-account>.dfs.core.windows.net:443 \
  -servername <storage-account>.dfs.core.windows.net \
  -showcerts 2>/dev/null > chain.raw

Extract the certificates:

awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} {print > ("cert-" n ".pem")}' chain.raw

Verify the extracted certificates:

for f in cert-*.pem; do
  echo "----- $f -----"
  openssl x509 -in "$f" -noout -subject -issuer 2>/dev/null
done

Import the required certificate into the truststore:

keytool -importcert -trustcacerts \
  -alias <azure-cert-alias> \
  -file cert-2.pem \
  -keystore "$JAVA_CACERTS_TRUSTSTORE" \
  -storepass <password>

For a cluster without SSL enabled, use the Java cacerts truststore. For an SSL-enabled cluster, use the truststore configured for Ranger.

Configure the Ranger Truststore

1. In the Ambari UI, go to Ranger > Configs > Advanced ranger-admin-site.
2. Configure the following properties:

ranger.truststore.alias=<azure-cert-alias>
ranger.truststore.file=$JAVA_CACERTS_TRUSTSTORE
ranger.truststore.password=<password>

1. Save the configuration.
2. Restart Ranger.