Certification Revocation List Support

[sushiMix]

Hello,

I'm trying to activate the CRL support in Strimzi Kafka using option provided in https://issues.apache.org/jira/browse/KAFKA-3700

jvmOptions: javaSystemProperties: - name: com.sun.security.enableCRLDP value: "true" - name: com.sun.net.ssl.checkRevocation value: "true"
When activating such option the cluster does not bootstrap anymore:

2022-02-24 08:55:26,238 ERROR [KafkaServer id=1] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer) [main] org.apache.kafka.common.config.ConfigException: Invalid value javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status for configuration A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings. at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.java:102) at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChannelBuilder.java:73) at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:192) at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:107) at kafka.network.Processor.<init>(SocketServer.scala:853) at kafka.network.SocketServer.newProcessor(SocketServer.scala:442) at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:299) at scala.collection.immutable.Range.foreach$mVc$sp(Range.scala:190) at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:297) at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:262) at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:259) at scala.collection.IterableOnceOps.foreach(IterableOnce.scala:563) at scala.collection.IterableOnceOps.foreach$(IterableOnce.scala:561) at scala.collection.AbstractIterable.foreach(Iterable.scala:919) at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:259) at kafka.network.SocketServer.startup(SocketServer.scala:131) at kafka.server.KafkaServer.startup(KafkaServer.scala:285) at kafka.Kafka$.main(Kafka.scala:109) at kafka.Kafka.main(Kafka.scala)

It seems that when activating such option all certificates need to have CRL entry.
Does the mechanism to generate internal certificates (interbroker link to zookeeper) can provide CRL entries ?

[scholzj]

No, the internal Cluster and Client CA do not support any form of CRL.