Connecting via cname

[kaykhan]

We have Kafka setup via AWS MSK. With AWS MSK you get 3 bootstrap addresses 1 for each broker. Using these addresses we were able to get kafka-ui running.

However creating a cname kafka-b1.acme.com based on these addresses and using those to connect with kafka-ui does not work and we get the following error:

2023-08-15 10:52:17,246 ERROR [parallel-3] c.p.k.u.s.StatisticsService: Failed to collect cluster acme-prod-msk info
java.lang.IllegalStateException: Error while creating AdminClient for Cluster acme-prod-msk
 at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$5(AdminClientServiceImpl.java:56)
 at reactor.core.publisher.Mono.lambda$onErrorMap$28(Mono.java:3773)
 at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:94)
 at reactor.core.publisher.MonoPeekTerminal$MonoTerminalPeekSubscriber.onError(MonoPeekTerminal.java:258)
 at reactor.core.publisher.FluxMapFuseable$MapFuseableConditionalSubscriber.onError(FluxMapFuseable.java:340)
 at reactor.core.publisher.MonoFlatMap$FlatMapMain.onError(MonoFlatMap.java:180)
 at reactor.core.publisher.MonoFlatMap$FlatMapMain.onError(MonoFlatMap.java:180)
 at reactor.core.publisher.MonoIgnoreThen$ThenIgnoreMain.onError(MonoIgnoreThen.java:278)
 at reactor.core.publisher.MonoPublishOn$PublishOnSubscriber.run(MonoPublishOn.java:187)
 at reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:68)
 at reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:28)
 at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
 at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
 at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
 at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
 at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching kafka-b2.acme.com found.
 at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
 at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:371)
 at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)
 at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
 at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
 at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
 at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
 at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
 at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
 at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
 at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
 at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
 at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
 at org.apache.kafka.common.network.SslTransportLayer.runDelegatedTasks(SslTransportLayer.java:435)
 at org.apache.kafka.common.network.SslTransportLayer.handshakeUnwrap(SslTransportLayer.java:523)
 at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:373)
 at org.apache.kafka.common.network.SslTransportLayer.handshake(SslTransportLayer.java:293)
 at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:178)
 at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:543)
 at org.apache.kafka.common.network.Selector.poll(Selector.java:481)
 at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:560)
 at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.processRequests(KafkaAdminClient.java:1415)
 at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1346)
 at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching kafka-b2.acme.com found.
 at java.base/sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:212)
 at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:103)
 at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:458)
 at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:418)
 at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:292)
 at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
 at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632)
 ... 19 common frames omitted

[Haarolean]

Hi, your truststore must have the certificates for your host. Feel free to use the in-app config wizard or configure the truststore path manually.
Docs