I've tried to connect for the first time to kafka cluster in Kubernetes (Strimzi operator) over TLS. The TLS connection is working as I am able to connect using kafkacat. The issue seems to be with the Java client only.
kafka-topics.sh --bootstrap-server=xxx.xxx.xxx.xxx:30199 --command-config security-properties.txt --list javax.net.ssl|FINE|01|main|2022-03-16 12:01:47.506
javax.net.ssl|FINE|01|main|2022-03-16 12:01:47.506 EDT|SSLCipher.java:438|jdk.tls.keyLimits: entry = AES/GCM/NoPadding KeyUpdate 2^37. AES/GCM/NOPADDING:KEYUPDATE = 137438953472
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:01:57.753 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:06.673 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:16.165 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:24.961 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:27.760 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:37.533 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
Error while executing topic command : Timed out waiting to send the call. Call: listTopics
[2022-03-16 12:02:47,592] ERROR org.apache.kafka.common.errors.TimeoutException: Timed out waiting to send the call. Call: listTopics
(kafka.admin.TopicCommand$)
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:47.597 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
javax.net.ssl|ALL|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:47.597 EDT|SSLEngineImpl.java:659|Closing outbound of SSLEngine
javax.net.ssl|WARNING|0D|kafka-admin-client-thread | adminclient-1|2022-03-16 12:02:47.598 EDT|SSLEngineOutputRecord.java:168|outbound has closed, ignore outbound application data
Locally, I have imported CA certificate as a PEM key and the user certificate and user key as a p12 file.
The configuration looks like this:
security.protocol=SSL
ssl.truststore.location=/usr/lib/jvm/java-1.8.0-amazon-corretto/jre/lib/security/CARoot.pem
ssl.keystore.location=/usr/lib/jvm/java-1.8.0-amazon-corretto/jre/lib/security/keyStore.p12
ssl.keystore.password=<redacted>
ssl.enabled.protocols=TLSv1.2
ssl.truststore.type=PEM
ssl.keystore.type=pkcs12
ssl.endpoint.identification.algorithm=