Apache Zeppelin with SSL

Apache Zeppelin is an awesome web based notebook that allows for interactive data analytics. It is architected to be language agnostic and (as of today) supports Scala (with Apache Spark), SparkSQL, Markdown and Shell.

In this post, we will describe how to configure a  Zeppelin notebook Server with SSL

Here is how to do it simply…

First Install Zeppelin

• Install Zeppelin
  • git clone https://github.com/apache/incubator-zeppelin.git
  • mvn clean package -Pspark-1.4 -Dhadoop.version=2.2.0 -Phadoop-2.2 -DskipTests
  • Note that, eventually, binaries will be available here

Create and install the certificate

Zeppelin uses Jetty under the covers, thus we’ll need to work with Java keystores.

The following steps are borrowed from this StackOverflow post:

• openssl genrsa -des3 -out jetty.key 2048
• openssl req -new -x509 -key jetty.key -out jetty.crt
• keytool -keystore keystore -import -alias jetty -file jetty.crt -trustcacerts
• openssl req -new -key jetty.key -out jetty.csr
• openssl pkcs12 -inkey jetty.key -in jetty.crt -export -out jetty.pkcs12
• keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype PKCS12 -destkeystore keystore

Configure the Zeppelin Server

• Rename zeppelin-site.xml.tempate to zeppelin-site.xml
  e.g. cp $ZEPPLIN_HOME/conf/zeppelin-site.xml.template $ZEPPLIN_HOME/conf/>zeppelin-site.xml
• Edit zeppelin-site.xml. Keep all settings in tact and modify following parameters as described below:

  [code language=”xml”]
  <property>
  <name>zeppelin.ssl</name>
  <value>true</value>
  <description>Should SSL be used by the servers?</description>
  </property>

  <property>
  <name>zeppelin.ssl.keystore.path</name>
  <value>/path/to/your/keystore</value> <!– destkeystore from above –>
  <description>Path to keystore relative to Zeppelin home</description>
  </property>

  <property>
  <name>zeppelin.ssl.keystore.password</name>
  <value>keystore-password</value>
  <description>Keystore password. Can be obfuscated by the Jetty Password tool</description>
  </property>

  <property>
  <name>zeppelin.ssl.truststore.path</name>
  <value>/path/to/your/keystore</value> <!– can have a separate truststore –>
  <description>Path to truststore relative to Zeppelin home. Defaults to the keystore path</description>
  </property>
  [/code]

Start the Zeppelin Server

• $ZEPPELIN_HOME/bin/zeppelin-daemon.sh start

Thanks!