Query fails when using the Greenplum Platform Extension Framework (PXF) to query external tables on a secure Cloudera Data Platform (CDP) cluster (e.g., Hive, HDFS)

Products

• VMware Tanzu Data Suite
• VMware Tanzu Greenplum

Issue/Introduction

When using the Greenplum Platform Extension Framework (PXF) to query external tables on a secure Cloudera Data Platform (CDP) cluster (e.g., Hive, HDFS), the query fails with the following error:

ERROR: PXF server error : PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

This occurs because the PXF Java Virtual Machine (JVM) on the segment hosts does not recognize or trust the SSL/TLS certificate issued by the CDP cluster's internal Certificate Authority (CA) or Auto-TLS provider.

Environment

PXF 6.9 

GPDB 6.28.1 

Cause

Standard Cloudera Data Platform deployments encrypt traffic for services like Hive Metastore, NameNode, and Knox. If CDP uses a corporate internal CA or self-signed certificates (such as those generated by FreeIPA), the PXF JVM truststore must be manually updated with the Root CA certificate to establish a secure connection.

Resolution

To resolve this permanently, you must import the CDP Root CA certificate into a custom truststore within `$PXF_BASE` and synchronize it across the entire Greenplum cluster.

1. Download the CDP Root CA Certificate: On the Greenplum Coordinator node, use scp to copy the certificate from the target CDP service. 
 

scp cm-auto-global_truststore.jks root@hostnameofpxfmasterserver:/usr/local/pxf-conf/conf/

 

2. Create a Custom PXF Truststore

Instead of modifying the system-wide Java truststore, create a local version in the PXF configuration directory so it can be managed via `pxf cluster sync`.

Copy the default Java truststore to PXF_BASE

cp $JAVA_HOME/lib/security/cacerts $PXF_BASE/conf/pxf-truststore.jks
chmod 644 $PXF_BASE/conf/pxf-truststore.jks

Import the CDP certificate into the new truststore
 Use the default password 'changeit' unless previously modified

keytool -import -trustcacerts -noprompt -alias cdp_root_ca \
  -file /tmp/cdp_cert.pem \
  -keystore $PXF_BASE/conf/pxf-truststore.jks \
  -storepass changeit

 

3. Update PXF JVM Options

Configure PXF to use the new truststore by updating the environment configuration file.

1.  Edit `$PXF_BASE/conf/pxf-env.sh`.
2.  Append the following SSL flags to `PXF_JVM_OPTS`:

 

export PXF_JVM_OPTS="$PXF_JVM_OPTS -Djavax.net.ssl.trustStore=$PXF_BASE/conf/pxf-truststore.jks -Djavax.net.ssl.trustStorePassword=changeit"

4. Synchronize and Restart PXF

Push the updated configuration and the new JKS file to all segment hosts and restart the service:

pxf cluster sync
pxf cluster restart

 

5. Verification

After restarting, rerun the external table query.