Possibly missing configuration fields in global configuration properties

[olliezhu]

I noticed that the Global configuration properties does not include some properties that I see in some guides for configuring Kafka clients with SSL. For example, this guide includes properties like ssl.truststore.location, ssl.truststore.password, and (optionally) ssl.truststore.type:

bootstrap.servers=kafka1:9093
security.protocol=SSL
ssl.truststore.location=/var/private/ssl/kafka.client.truststore.jks
ssl.truststore.password=test1234
ssl.keystore.location=/var/private/ssl/kafka.client.keystore.jks
ssl.keystore.password=test1234
ssl.key.password=test1234

Does anyone have an explanation for this discrepancy? For context, I'm somewhat new to using Kafka and am adding support for SSL (more specifically would like to enable mTLS) to some software that will be acting as a Kafka client.

[edenhill]

TrustStore and KeyStores are Java KeyStores, specific to the Java client and not something librdkafka supports (being a non-Java client).
librdkafka relies on the more standard PEM and PKCS#12(PFX) formats.

[olliezhu]

@edenhill Thanks, that's good to know. So if I wanted to be able to configure a client for mTLS, would be sufficient to just support these configurations?

    "ssl.ca.location",
    "ssl.certificate.location",
    "ssl.key.location",
    "ssl.key.password",

Otherwise, I'm looking at a longer list of SSL-related configurations that would work with confluent-kafka-python.

    "ssl.ca.location",
    "ssl.ca.certificate.stores",
    "ssl.certificate.location",
    "ssl.certificate.pem",
    "ssl.cipher.suites",
    "ssl.crl.location",
    "ssl.curves.list",
    "ssl.endpoint.identification.algorithm",
    "ssl.key.location",
    "ssl.key.password",
    "ssl.key.pem",
    "ssl.keystore.location",
    "ssl.keystore.password",
    "ssl.sigalgs.list",

[edenhill]

Yeah, those four should be sufficient.