Configure Azure Endpoint SSL Properties in Ranger

Configure Ranger to trust the Azure storage endpoint certificate.

Import the Azure Certificate

Create a directory for the certificates:

mkdir -p .azure-certs cd .azure-certs

Retrieve the Azure certificate chain:

echo | openssl s_client \ -connect <storage-account>.dfs.core.windows.net:443 \ -servername <storage-account>.dfs.core.windows.net \ -showcerts 2>/dev/null > chain.raw

Extract the certificates:

awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} {print > ("cert-" n ".pem")}' chain.raw

Verify the extracted certificates:

for f in cert-*.pem; do echo "----- $f -----" openssl x509 -in "$f" -noout -subject -issuer 2>/dev/null done

Import the required certificate into the truststore:

keytool -importcert -trustcacerts \ -alias <azure-cert-alias> \ -file cert-2.pem \ -keystore "$JAVA_CACERTS_TRUSTSTORE" \ -storepass <password>

For a cluster without SSL enabled, use the Java cacerts truststore. For an SSL-enabled cluster, use the truststore configured for Ranger.

Configure the Ranger Truststore

In the Ambari UI, go to Ranger > Configs > Advanced ranger-admin-site.
Configure the following properties:

ranger.truststore.alias=<azure-cert-alias> ranger.truststore.file=$JAVA_CACERTS_TRUSTSTORE ranger.truststore.password=<password>

Save the configuration.
Restart Ranger.

Last updated on Aug 31, 2026

Was this page helpful?