Unable to try TLS without authentication

[MandarJKulkarni]

I have installed strimzi kafka operators followed by a kafka cluster with the yaml from here.

The custom resource kafka my-cluster has below value.

  Listeners:
    Addresses:
      Host:             my-cluster-kafka-bootstrap.kafka.svc
      Port:             9092
    Bootstrap Servers:  my-cluster-kafka-bootstrap.kafka.svc:9092
    Type:               plain
    Addresses:
      Host:             my-cluster-kafka-bootstrap.kafka.svc
      Port:             9093
    Bootstrap Servers:  my-cluster-kafka-bootstrap.kafka.svc:9093
    Certificates:
      -----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

    Type:               tls
  Observed Generation:  1
Events:                 <none>

I have extracted the /opt/kafka/cluster-ca-certs/ca.crt into a keystore.jks and stored it as a truststore using keypassword from /opt/kafka/cluster-ca-certs/ca.password.

I have created a client.properties with below values.
security.protocol=SSL
ssl.truststore.location=/tmp/kafka/testkeystore.jks
ssl.truststore.password=test123

I am getting handshake errors when I try to use console-producer.

bin/kafka-console-producer.sh --topic mytopic --bootstrap-server localhost:9093 --producer.config /tmp/kafka/client.properties

ERROR [Producer clientId=console-producer] Connection to node -1 (localhost/127.0.0.1:9093) failed authentication due to: SSL handshake failed (org.apache.kafka.clients.NetworkClient)

What could I be missing?

Appreciate any help. I have double checked that the certificate import is correct.

[scholzj]

I'm not sure what did you used the ca.password for - that is a password for the PKCS12 file.

I guess you can:

• describe exactly all steps which you did to make it easier to understand what could have been wrong
• Use the -Djavax.net.debug=ssl java property for the console producer - that should give us more Java information (you should be able to use it for example via the KAFKA_OPTS environment variable)
• I think you will run into issues with the TLS hostname verification (since the right address is my-cluster-kafka-bootstrap.kafka.svc:9093 and not localhost:9093) - but I think that gives another error.

That should give us. bit more insights into what went wrong and why does it not work for you.

[MandarJKulkarni]

Thank you very much for the reply. Setting -Djavax.net.debug=ssl helped.

The error log was like below:

[2021-05-02 09:48:14,832] WARN [Producer clientId=console-producer] Bootstrap broker localhost:9093 (id: -1 rack: null) disconnected (org.apache.kafka.clients.NetworkClient)
javax.net.ssl|DEBUG|0C|kafka-producer-network-thread | console-producer|2021-05-02 09:48:14.960 UTC|SSLCipher.java:1840|KeyLimit read side: algorithm = AES/GCM/NOPADDING:KEYUPDATE
countdown value = 137438953472
javax.net.ssl|DEBUG|0C|kafka-producer-network-thread | console-producer|2021-05-02 09:48:14.963 UTC|SSLCipher.java:1994|KeyLimit write side: algorithm = AES/GCM/NOPADDING:KEYUPDATE
countdown value = 137438953472
javax.net.ssl|ERROR|0C|kafka-producer-network-thread | console-producer|2021-05-02 09:48:14.970 UTC|TransportContext.java:341|Fatal (CERTIFICATE_UNKNOWN): **No subject alternative DNS name matching localhost found.** (
"throwable" : {
  java.security.cert.CertificateException: **No subject alternative DNS name matching localhost found**.
        at java.base/sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:212)
        at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:103)

This made me realize that the certificate doesn't have localhost as DNS name.

So when I tried the console producer (and consumer) with --bootstrap-server my-cluster-kafka-bootstrap.kafka.svc:9093, things worked out fine.

Actually I had kubectl exec-ed into the pod my-cluster-kafka-0 to test the console producer and consumers. So localhost;9092 was working fine and hence I was trying with localhost:9093.
But I realize what was incorrect and the issue is resolved now.