Deploy Tableau Server37% of the exam
SSL, extract encryption, KMS and Kerberos SPNs
How to configure external SSL (including behind load balancers), repository SSL for local and external repositories, hardening for internal traffic, extract encryption at rest with its key management options, and the SPNs and keytabs that Kerberos single sign-on needs.
2.3 Implement encryption: 2.3.1 Implement SSL encryption; 2.3.2 Implement database encryption; 2.3.3 Implement extract encryption; 2.3.4 Set up service principal names (SPNs) for Kerberos.
~8 min read · 22 practice questions
What the exam expects
- Configure external SSL for single and load-balanced gateways, replace certificates correctly and restrict TLS versions.
- Encrypt repository traffic for local and external repositories, and harden internal secrets and inter-node traffic.
- Choose the Extract Encryption at Rest mode and predict its jobs, limits, key rotation and backup effects.
- Pick a key management system (KMS) and meet its deployment prerequisites.
- Create SPNs and keytabs for Kerberos, and troubleshoot name mismatches. Kerberos sign-in design is taught in SAML, Kerberos, OpenID Connect and Entra ID sign-in.
Key terms:
- External SSL: TLS on the gateway for client traffic.
- Repository SSL: TLS between the PostgreSQL repository and server components or direct clients.
- Master extract key (MEK): the key that encrypts extract keys; it is protected by the root master key (RMK).
- SPN: service principal name, the Active Directory name a Kerberos client requests a ticket for.
- Keytab: a file of a principal's keys, generated with
ktpass.
Key facts
Certificate replacement
- Detail
- Through TSM web UI or
external-ssl enable, never OS file copy
Chain file
- Detail
- Required for Desktop on Mac and Prep Builder
Shared SSL/SAML key
- Detail
- Must not be passphrase protected
Recommended
ssl.protocols- Detail
all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
Inter-node traffic
- Detail
- Not secured; use firewalls and a segregated VLAN
After regenerating tokens
- Detail
- New node configuration file for added nodes
External repository SSL later
- Detail
repository-ssl enable --certificate <path>
Direct repository clients
- Detail
- Get
server.crtonly
Key rotation per site
- Detail
tabcmd reencryptextracts <site>
Backup growth
- Detail
- Up to 50-100% with encrypted extracts
Azure Key Vault
- Detail
- Server must be deployed in Azure
kms status scope- Detail
- Administration Controller node only
AES keytab
- Detail
ktpassneeds/mapuser
Sources for this section (8)
- External SSLhelp.tableau.com (opens in a new tab)
- Hardening Checklisthelp.tableau.com (opens in a new tab)
- tsm securityhelp.tableau.com (opens in a new tab)
- Direct Connectionshelp.tableau.com (opens in a new tab)
- Extract Encryption at Resthelp.tableau.com (opens in a new tab)
- Azure Key Vaulthelp.tableau.com (opens in a new tab)
- AWS KMShelp.tableau.com (opens in a new tab)
- Keytab Requirementshelp.tableau.com (opens in a new tab)
- What happens to requests on port 80 after external SSL is configured?
- Why might the first viewer of an encrypted extract see a slightly slower load than later viewers?
- Why does a Kerberos SSO test from the Tableau Server computer's own browser at
localhostfail? - Which log holds external SSL validation and encryption errors?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Tableau Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 18 lessons of the Tableau Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (22 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both