# SSL, extract encryption, KMS and Kerberos SPNs

*Tableau Architect Study Guide · Deploy Tableau Server · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-architect/deploy-tableau-server/ssl-extract-encryption-kms-and-kerberos-spns*

How to configure external SSL (including behind load balancers), repository SSL for local and external repositories, hardening for internal traffic, extract encryption at rest with its key management options, and the SPNs and keytabs that Kerberos single sign-on needs.

- Certification: Salesforce Tableau Architect
- Exam section: Deploy Tableau Server
- Study guide: https://www.certifyforce.com/study-guide/tableau-architect

**Official exam objective:**

> 2.3 Implement encryption: 2.3.1 Implement SSL encryption; 2.3.2 Implement database encryption; 2.3.3 Implement extract encryption; 2.3.4 Set up service principal names (SPNs) for Kerberos.

## What the exam expects

- Configure external SSL for single and load-balanced gateways, replace certificates correctly and restrict TLS versions.
- Encrypt repository traffic for local and external repositories, and harden internal secrets and inter-node traffic.
- Choose the Extract Encryption at Rest mode and predict its jobs, limits, key rotation and backup effects.
- Pick a key management system (KMS) and meet its deployment prerequisites.
- Create SPNs and keytabs for Kerberos, and troubleshoot name mismatches. Kerberos sign-in design is taught in SAML, Kerberos, OpenID Connect and Entra ID sign-in.

Key terms:
- **External SSL:** TLS on the gateway for client traffic.
- **Repository SSL:** TLS between the PostgreSQL repository and server components or direct clients.
- **Master extract key (MEK):** the key that encrypts extract keys; it is protected by the root master key (RMK).
- **SPN:** service principal name, the Active Directory name a Kerberos client requests a ticket for.
- **Keytab:** a file of a principal's keys, generated with `ktpass`.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Certificate replacement | Through TSM web UI or `external-ssl enable`, never OS file copy | [External SSL](https://help.tableau.com/current/server/en-us/ssl_config.htm) |
| Chain file | Required for Desktop on Mac and Prep Builder | [External SSL](https://help.tableau.com/current/server/en-us/ssl_config.htm) |
| Shared SSL/SAML key | Must not be passphrase protected | [External SSL](https://help.tableau.com/current/server/en-us/ssl_config.htm) |
| Recommended `ssl.protocols` | `all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1` | [Hardening Checklist](https://help.tableau.com/current/server/en-us/security_harden.htm) |
| Inter-node traffic | Not secured; use firewalls and a segregated VLAN | [Hardening Checklist](https://help.tableau.com/current/server/en-us/security_harden.htm) |
| After regenerating tokens | New node configuration file for added nodes | [tsm security](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm) |
| External repository SSL later | `repository-ssl enable --certificate <path>` | [tsm security](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm) |
| Direct repository clients | Get `server.crt` only | [Direct Connections](https://help.tableau.com/current/server/en-us/ssl_config_direct_cx.htm) |
| Key rotation per site | `tabcmd reencryptextracts <site>` | [Extract Encryption at Rest](https://help.tableau.com/current/server/en-us/security_ear.htm) |
| Backup growth | Up to 50-100% with encrypted extracts | [Extract Encryption at Rest](https://help.tableau.com/current/server/en-us/security_ear.htm) |
| Azure Key Vault | Server must be deployed in Azure | [Azure Key Vault](https://help.tableau.com/current/server/en-us/security_kms_azure.htm) |
| `kms status` scope | Administration Controller node only | [AWS KMS](https://help.tableau.com/current/server/en-us/security_kms_aws.htm) |
| AES keytab | `ktpass` needs `/mapuser` | [Keytab Requirements](https://help.tableau.com/current/server/en-us/kerberos_keytab.htm) |

## Check yourself

- What happens to requests on port 80 after external SSL is configured?
- Why might the first viewer of an encrypted extract see a slightly slower load than later viewers?
- Why does a Kerberos SSO test from the Tableau Server computer's own browser at `localhost` fail?
- Which log holds external SSL validation and encryption errors?

## Sources

- [Configure SSL for External HTTP Traffic to and from Tableau Server](https://help.tableau.com/current/server/en-us/ssl_config.htm)
- [tsm security](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm)
- [Security Hardening Checklist](https://help.tableau.com/current/server/en-us/security_harden.htm)
- [Configure SSL for Internal Postgres Communication](https://help.tableau.com/current/server/en-us/ssl_config_postgres.htm)
- [Configure Postgres SSL to Allow Direct Connections from Clients](https://help.tableau.com/current/server/en-us/ssl_config_direct_cx.htm)
- [Extract Encryption at Rest](https://help.tableau.com/current/server/en-us/security_ear.htm)
- [Tableau Server Key Management System](https://help.tableau.com/current/server/en-us/security_kms.htm)
- [AWS Key Management System](https://help.tableau.com/current/server/en-us/security_kms_aws.htm)
- [Azure Key Vault](https://help.tableau.com/current/server/en-us/security_kms_azure.htm)
- [Understanding Keytab Requirements](https://help.tableau.com/current/server/en-us/kerberos_keytab.htm)
- [Troubleshoot Kerberos](https://help.tableau.com/current/server/en-us/kerberos_trouble.htm)
- [Kerberos Requirements](https://help.tableau.com/current/server/en-us/kerberos_requ.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 22 linked practice questions, and unlimited timed mock exams are included with the Tableau Architect pack (USD $19): https://www.certifyforce.com/practice-exams