Getting Failed authentication with /127.0.0.1 (SSL handshake failed) (org.apache.kafka.common.network.Selector) in kafka producer

user_17622586 0
Viewed 290

I configured SSL in kafka using the following commands:-

  1. Generate CA
openssl req -new -x509 -keyout ca-key -out ca-cert -days 3650
  1. Create Truststore
keytool -keystore kafka.server.truststore.jks -alias ca-cert -import -file ca-cert
  1. Create Keystore
keytool -keystore kafka.server.keystore.jks -alias kafka -validity 3650 -genkey -keyalg RSA -ext SAN=dns:localhost
  1. Create certificate signing request (CSR)
keytool -keystore kafka.server.keystore.jks -alias kafka -certreq -file ca-request-zookeeper
  1. Sign the CSR
openssl x509 -req -CA ca-cert -CAkey ca-key -in ca-request-kafka -out ca-signed-kafka -days 3650 -CAcreateserial
  1. Import the CA into Keystore
keytool -keystore kafka.server.keystore.jks -alias ca-cert -import -file ca-cert
  1. Import the signed certificate from step 5 into Keystore
keytool -keystore kafka.server.keystore.jks -alias kafka -import -file ca-signed-kafka

and added the following properties in server.properties file:-

ssl.truststore.location=PATH-TO-YOUR-KAFKA-DIR/ssl/kafka.broker0.truststore.jks

ssl.truststore.password=vinodts

ssl.keystore.location=PATH-TO-YOUR-KAFKA-DIR/ssl/kafka.broker0.keystore.jks

ssl.keystore.password=vinodks

ssl.key.password=vinodks

security.inter.broker.protocol=SSL

ssl.client.auth=required

ssl.protocol=TLSv1.2

and SSL in kafka server running on localhost:9092 is successfully running.

I used the following commands for creating CA's for kafka-console-producer:-

keytool -keystore kafka.producer.truststore.jks -alias ca-cert -import -file ca-cert


keytool -keystore kafka.producer.keystore.jks -alias kafka-producer -validity 3650 -genkey -keyalg RSA -ext SAN=dns:localhost


keytool -keystore kafka.producer.keystore.jks -alias kafka-producer -certreq -file ca-request-producer


openssl x509 -req -CA ca-cert -CAkey ca-key -in ca-request-producer -out ca-signed-producer -days 3650 -CAcreateserial


keytool -keystore kafka.producer.keystore.jks -alias ca-cert -import -file ca-cert


keytool -keystore kafka.producer.keystore.jks -alias kafka-producer -import -file ca-signed-producer

added the following properties in producer.properties file:-
bootstrap.servers=localhost:9092

security.protocol=SSL

ssl.protocol=TLSv1.2

ssl.truststore.location=PATH-TO-YOUR-KAFKA-DIR/ssl/kafka.producer.truststore.jks

ssl.truststore.password=vinodts

ssl.keystore.location=PATH-TO-YOUR-KAFKA-DIR/ssl/kafka.producer.keystore.jks

ssl.keystore.password=vinodks

ssl.key.password=vinodks1

Now when i try to run the command:

kafka-console-producer.bat --topic ssl-topic ../../config/producer.properties --broker-list localhost:9092

I get:

Bootstrap broker localhost:9092 (id: -1 rack: null) disconnected (org.apache.kafka.clients.NetworkClient) In producer window and get Failed authentication with /127.0.0.1 (SSL handshake failed) (org.apache.kafka.common.network.Selector) in kafka window.

Does anybody know what I am doing wrong? Thanks in advance

apache-kafka ssl-certificate ssl
1 Answers

INFO [SocketServer listenerType=ZK_BROKER, nodeId=0] Failed authentication with /127.0.0.1 (channelId=127.0.0.1:9092-127.0.0.1:55412-1) (SSL handshake failed) (org.apache.kafka.common.network.Selector)

 cd kafka/config

create a new ssl.config file and paste the below lines

    ssl.endpoint.identification.algorithm=https
    security.protocol=SSL
    ssl.keystore.location=kafka/ssl/kafka.broker0.keystore.jks
    ssl.keystore.password=password
    ssl.key.password=password
    ssl.truststore.location=kafka/ssl/kafka.broker0.truststore.jks
    ssl.truststore.password=passWord

Now you try with(--command-config config/ssl.config)

    sudo bin/kafka-topics.sh --list --bootstrap-server localhost:9092 --command-config config/ssl.config

it's working

user_194870910
Related