Confluent kafka python SSL verification

user_1768610 0
Viewed 2555

I am using confluent kafka python 'https://github.com/confluentinc/confluent-kafka-python' for writing application. Both kafka and schema registry is secured and uses https endpoints.

While running the application, i am getting following error

Result: Failure Exception: SSLError: HTTPSConnectionPool(host='hostname', port=443): 
Max retries exceeded with url: //subjects/schema-value/versions (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

Question 1:

For connecting to schema registry, where to specify the ceritificate value ?

Question 2:

For testing, i want to disable SSL verification in python, What is the option to do that ?

Thanks in advance.

kafka-producer-api confluent-platform apache-kafka ssl-certificate python
1 Answers

This is the config that I used for my avro producer:

avro_producer_conf = {
    "bootstrap.servers": "SSL://127.0.0.1:9094",
    "security.protocol": "ssl",
    # Certificates used by simple Producer
    "ssl.ca.location": "/ssl/root/intermediate/ca-chain.cert.pem",
    "ssl.certificate.location": "/ssl/root/intermediate/producer/producer.cert.pem",
    "ssl.key.location": "/ssl/root/intermediate/producer/producer.key.pem",
    'schema.registry.url': "https://schemaregistry:8081",
    # Certificates used by Schema Registry
    "schema.registry.ssl.ca.location": "/ssl/root/intermediate/ca-chain.cert.pem",
    "schema.registry.ssl.certificate.location": "/ssl/root/intermediate/producer/producer.cert.pem",
    "schema.registry.ssl.key.location": "/ssl/root/intermediate/producer/producer.key.pem"
}

The AvroProducer __init__() method is doing the separation of parameters. Everything you want to pass to SchemaRegistry needs to start with schema.registry.<parameter>. To use SSL with Schema registry make sure you use a non-encrypted key(private key without password). Make sure you don't have REQUESTS_CA_BUNDLE environment variable set, it will confuse the library.

user_100212900
Related