strimzi-kafka self signed CA certificates for the cluster

[rohitChewbacca]

Hi Team,

We need to generate our own self signed CA certificates to connect our Kafka brokers and respective clients.
Currently we tried the following

1. Tried using existing CA certificates which we use for our istio-ingress
2. Tried generating a new set of certificate and key using openssl
   In both of these cases when we tried bringing up the kafka brokers, it failed with an error saying cannot find CA certificates.
   Kindly please help us in resolving this issue.

[scholzj]

How does this differ from #5147 (comment)?

[rohitChewbacca]

We are able to use the strimzi-operator generated certificates. But we dont want it to get generated by strimzi.
Instead want our own custom certificates to be used.

[scholzj]

But how does that differ from the question in the other thread?

[scholzj]

I mean, nobody wants to answer the same question multiple times. So please clarify the differences and if the questions are the same, decide which one to use and delete the other one.

[rohitChewbacca]

Hi @scholzj ,
#5147 (comment) - has been resolved as mentioned in the thread, that was a SSL handshake error.
Now we wanted to generate our own custom certificates instead of using the strimzi-kafka generated certificates to connect to our brokers from client.
Needed help in generating these certificates as it didnt work with the CA certificates that we already had
Maybe , we can have a working session , to explain the issue if possible.

[scholzj]

So what exactly did not worked? Normally, it is just a CA. The only important thing is that it has to be markes in the X509 Extensions as CA:True. This is an example of a CA which works: https://github.com/scholzj/strimzi-custom-ca-test