I setup the SSL for kafka. First of all, I create the keystore and trustore by following command :
keytool -keystore server.keystore.jks -alias localhost -validity 1000 -genkey
keytool -importkeystore -srckeystore server.keystore.jks -destkeystore server.keystore.jks -deststoretype pkcs12
openssl req -new -x509 -keyout ca-key -out ca-cert -days 1000
keytool -keystore server.truststore.jks -alias CARoot -import -file ca-cert
keytool -keystore client.truststore.jks -alias CARoot -import -file ca-cert
keytool -keystore server.keystore.jks -alias localhost -certreq -file cert-file
openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-signed -days 1000 -CAcreateserial -passin pass:1234
keytool -keystore server.keystore.jks -alias CARoot -import -file ca-cert
keytool -keystore server.keystore.jks -alias localhost -import -file cert-signed
openssl s_client -debug -connect localhost:9093 -tls1_2
And then I config the server.properties as following:
listeners=PLAINTEXT://localhost:9092,SSL://localhost:9093
security.protocol = SSL
ssl.keystore.location=/opt/hk/bin/cert/kafka/server.keystore.jks
ssl.keystore.password=1234
ssl.key.password=tuhk1234
ssl.truststore.location=/opt/hk/bin/cert/kafka/server.truststore.jks
ssl.truststore.password=1234
ssl.client.auth=none
ssl.enabled.protocols=TLSv1.2
ssl.keystore.type=JKS
ssl.truststore.type=JKS
Then i try to config the producer.properties as following :
bootstrap.servers=localhost:9093
security.protocol=SSL
ssl.truststore.location=/opt/hk/bin/cert/kafka/client.truststore.jks
ssl.truststore.password=1234
ssl.enabled.protocols=TLSv1.2
I startup the producer as following
./bin/kafka-console-producer.sh --broker-list localhost:9093 --topic test --producer.config ./config/producer.properties
But it got the following exception
[2020-08-31 10:35:00,136] ERROR [Producer clientId=console-producer] Connection to node -1 (localhost/127.0.0.1:9093) failed authentication due to: SSL handshake failed (org.apache.kafka.clients.NetworkClient) [2020-08-31 10:35:00,137] WARN [Producer clientId=console-producer] Bootstrap broker localhost:9093 (id: -1 rack: null) disconnected (org.apache.kafka.clients.NetworkClient)
Anyone can help ?