1. On the Cloudera Manager Server host, type the following commands to install the Cloudera Manager packages.

   OS	Command
   RHEL, CentOS, Oracle Linux	sudo yum install cloudera-manager-daemons cloudera-manager-agent cloudera-manager-server
   SLES	sudo zypper install cloudera-manager-daemons cloudera-manager-agent cloudera-manager-server
   Ubuntu	sudo apt-get install cloudera-manager-daemons cloudera-manager-agent cloudera-manager-server

2. If you are using an Oracle database for Cloudera Manager Server, edit the /etc/default/cloudera-scm-server file on the Cloudera Manager server host. Locate the line that begins with export CM_JAVA_OPTS and change the -Xmx2G option to -Xmx4G.

  Note: The following procedure enables auto-TLS using an internal certificate authority (CA) created and managed by Cloudera Manager. To use a trusted public CA, you must first obtain the certificates for your cluster hosts. For more information, see Configuring TLS Encryption for Cloudera Manager and CDH Using Auto-TLS .

Auto-TLS greatly simplifies the process of enabling and managing TLS encryption on your cluster. It automates the creation of an internal certificate authority (CA) and deployment of certificates across all cluster hosts. It can also automate the distribution of existing certificates, such as those signed by a public CA. Adding new cluster hosts or services to a cluster with auto-TLS enabled automatically creates and deploys the required certificates.

You must enable Auto-TLS before adding any hosts to Cloudera Manager. To enable auto-TLS with a Cloudera Manager CA, run the following command:

sudo JAVA_HOME=/usr/java/jdk1.8.0_141-cloudera /opt/cloudera/cm-agent/bin/certmanager setup --configure-services

Replace jdk1.8.0_141-cloudera with your JDK version. If you want to store the files in a directory other than the default (/var/lib/cloudera-scm-server/certmanager), add the --location option as follows:

sudo JAVA_HOME=/usr/java/jdk1.8.0_141-cloudera /opt/cloudera/cm-agent/bin/certmanager --location /path/to/alternate/directory setup --configure-services

Check the /var/log/cloudera-scm-agent/certmanager.log log file to confirm that the /var/lib/cloudera-scm-server/certmanager/* directories were created.

That's it! When you start Cloudera Manager Server, it will have TLS enabled, and all hosts and services that you add to the cluster will automatically have TLS configured and enabled.

For more information about auto-TLS, see Configuring TLS Encryption for Cloudera Manager and CDH Using Auto-TLS .

After installing the Cloudera Manager Server packages, continue to Step 4: Install and Configure Databases.