Configure SSL for Hue Using a PKCS12 Certificate on ODP

This article explains how to enable SSL for Hue using a PKCS12 (.p12) certificate file.

Use this procedure when Hue is accessible over HTTP and you want to enable HTTPS access.

Symptoms

After enabling SSL, Hue may fail to start or HTTPS access may not work.

Common causes include:

• Incorrect certificate configuration
• Missing certificate chain
• Invalid private key permissions
• Missing SSL password configuration

Prerequisites

Ensure you have:

• A valid PKCS12 certificate file (.p12)
• The certificate password
• Access to the Hue host

Extract the Certificate Files

Extract the private key

xxxxxxxxxx

openssl pkcs12 \

-in /etc/hue/ssl/hue.p12 \

-nocerts -nodes \

-out /etc/hue/ssl/server.key

Set permissions:

xxxxxxxxxx

chmod 400 /etc/hue/ssl/server.key

Extract the server certificate

xxxxxxxxxx

openssl pkcs12 \

-in /etc/hue/ssl/hue.p12 \

-clcerts -nokeys \

-out /etc/hue/ssl/server.crt

Set permissions:

xxxxxxxxxx

chmod 644 /etc/hue/ssl/server.crt

Extract the certificate chain

xxxxxxxxxx

openssl pkcs12 \

-in /etc/hue/ssl/hue.p12 \

-cacerts -nokeys -chain \

-out /etc/hue/ssl/chain.pem

Set permissions:

xxxxxxxxxx

chmod 644 /etc/hue/ssl/chain.pem

Create the Full Certificate Chain

Combine the server certificate and certificate chain:

xxxxxxxxxx

cat /etc/hue/ssl/server.crt \

/etc/hue/ssl/chain.pem \

> /etc/hue/ssl/fullchain.crt

Set permissions:

xxxxxxxxxx

chmod 644 /etc/hue/ssl/fullchain.crt

Configure Hue SSL

Update the Hue SSL settings:

xxxxxxxxxx

ssl_certificate={{desktop_ssl_certificate}}

ssl_private_key={{desktop_ssl_private_key}}

ssl_certificate_chain={{desktop_ssl_certificate_chain}}

ssl_password_script={{desktop_ssl_password_script}}

Configure the corresponding values in Ambari.

Set File Ownership

xxxxxxxxxx

chown -R hue:hue /opt/certs

chmod 750 /opt/certs

Ensure:

xxxxxxxxxx

server.key      400

server.crt      644

chain.pem       644

fullchain.crt   644

Verify the Certificate

Verify the private key

xxxxxxxxxx

openssl rsa -in server.key -check -noout

Verify the key matches the certificate

xxxxxxxxxx

openssl x509 -noout -modulus -in server.crt | openssl md5

openssl rsa -noout -modulus -in server.key | openssl md5

Both values should match.

Verify the certificate chain

xxxxxxxxxx

openssl verify -CAfile chain.pem fullchain.crt

Expected output:

xxxxxxxxxx

fullchain.crt: OK

Configure the SSL Password

If the private key is password protected:

1. Configure the Hue SSL password in Ambari.
2. Use the same password that was used to protect the private key.

Restart Hue

Restart the Hue service from Ambari.

After the restart completes, access Hue using:

xxxxxxxxxx

https://<hue-host>:8888

Validation

Verify:

• Hue starts successfully.
• HTTPS access works.
• Browser certificate warnings are not present.
• HDFS File Browser loads successfully.

Summary

To enable SSL for Hue:

1. Extract the private key, server certificate, and certificate chain from the PKCS12 file.
2. Create a full certificate chain file.
3. Configure the SSL properties in Hue.
4. Set correct file ownership and permissions.
5. Configure the SSL password if the key is encrypted.
6. Restart Hue and validate HTTPS access.

This procedure resolves most SSL enablement issues for Hue deployments using PKCS12 certificates.