Configure SSL for Hue Using a PKCS12 Certificate on ODP

This article explains how to enable SSL for Hue using a PKCS12 (.p12) certificate file.

Use this procedure when Hue is accessible over HTTP and you want to enable HTTPS access.

Symptoms

After enabling SSL, Hue may fail to start or HTTPS access may not work.

Common causes include:

Incorrect certificate configuration
Missing certificate chain
Invalid private key permissions
Missing SSL password configuration

Prerequisites

Ensure you have:

A valid PKCS12 certificate file (.p12)
The certificate password
Access to the Hue host

Extract the Certificate Files

Extract the private key

openssl pkcs12 \ -in /etc/hue/ssl/hue.p12 \ -nocerts -nodes \ -out /etc/hue/ssl/server.key

Set permissions:

chmod 400 /etc/hue/ssl/server.key

Extract the server certificate

openssl pkcs12 \ -in /etc/hue/ssl/hue.p12 \ -clcerts -nokeys \ -out /etc/hue/ssl/server.crt

Set permissions:

chmod 644 /etc/hue/ssl/server.crt

Extract the certificate chain

openssl pkcs12 \ -in /etc/hue/ssl/hue.p12 \ -cacerts -nokeys -chain \ -out /etc/hue/ssl/chain.pem

Set permissions:

chmod 644 /etc/hue/ssl/chain.pem

Create the Full Certificate Chain

Combine the server certificate and certificate chain:

cat /etc/hue/ssl/server.crt \ /etc/hue/ssl/chain.pem \ > /etc/hue/ssl/fullchain.crt

Set permissions:

chmod 644 /etc/hue/ssl/fullchain.crt

Configure Hue SSL

Update the Hue SSL settings:

ssl_certificate={{desktop_ssl_certificate}} ssl_private_key={{desktop_ssl_private_key}} ssl_certificate_chain={{desktop_ssl_certificate_chain}} ssl_password_script={{desktop_ssl_password_script}}

Configure the corresponding values in Ambari.

Set File Ownership

chown -R hue:hue /opt/certs chmod 750 /opt/certs

Ensure:

server.key 400 server.crt 644 chain.pem 644 fullchain.crt 644

Verify the Certificate

Verify the private key

openssl rsa -in server.key -check -noout

Verify the key matches the certificate

openssl x509 -noout -modulus -in server.crt | openssl md5 openssl rsa -noout -modulus -in server.key | openssl md5

Both values should match.

Verify the certificate chain

openssl verify -CAfile chain.pem fullchain.crt

Expected output:

fullchain.crt: OK

Configure the SSL Password

If the private key is password protected:

Configure the Hue SSL password in Ambari.
Use the same password that was used to protect the private key.

Restart Hue

Restart the Hue service from Ambari.

After the restart completes, access Hue using:

https://<hue-host>:8888

Validation

Verify:

Hue starts successfully.
HTTPS access works.
Browser certificate warnings are not present.
HDFS File Browser loads successfully.

Summary

To enable SSL for Hue:

Extract the private key, server certificate, and certificate chain from the PKCS12 file.
Create a full certificate chain file.
Configure the SSL properties in Hue.
Set correct file ownership and permissions.
Configure the SSL password if the key is encrypted.
Restart Hue and validate HTTPS access.

This procedure resolves most SSL enablement issues for Hue deployments using PKCS12 certificates.

Last updated on

Was this page helpful?