SSL hand shake error even after disabling the host verification

[vamshikrishnamraju]

Hi

My requirement is to create a MM2 for two external kafka clusters. So below is my configuration yaml file.

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaMirrorMaker2
metadata:
  name: test-mirror-maker2
spec:
  version: 3.3.2
  replicas: 1
  resources:
    requests:
      cpu: "500m"
      memory: 2Gi
    limits:
      cpu: "1.5"
      memory: 2Gi
  jvmOptions:
    "-Xmx": "1g"
    "-Xms": "1g"
  connectCluster: "test-kafka"
  clusters:
  - alias: "source-kafka"
    bootstrapServers: dummy-ip:9094
    tls:
      trustedCertificates:
        - secretName: source-ca-crt
          certificate: ca.crt
    config:
      ssl.endpoint.identification.algorithm: " "
  - alias: "target-kafka"
    bootstrapServers: dummy-ip-2:9094
    tls:
      trustedCertificates:
        - secretName: target-ca-crt
          certificate: ca.crt  
    config:
      producer.max.request.size: 15728640
      config.storage.replication.factor: 1
      offset.storage.replication.factor: 1
      status.storage.replication.factor: 1 
      ssl.endpoint.identification.algorithm: " "
  mirrors:
  - sourceCluster: "source-kafka"
    targetCluster: "target-kafka"
    sourceConnector:
      config:
        replication.factor: 1
        offset-syncs.topic.replication.factor: 1
        sync.topic.acls.enabled: "false"
        ssl.endpoint.identification.algorithm: " "
    heartbeatConnector:
      config:
        heartbeats.topic.replication.factor: 1
        ssl.endpoint.identification.algorithm: " "
    checkpointConnector:
      config:
        tasks.max: 1
        checkpoints.topic.replication.factor: 1
        ssl.endpoint.identification.algorithm: " "
      tasksMax: 1
    topicsPattern: "sometopic"
    #groupsPattern: ".*"

I see that in target source-kafka.sometopic is created but when MM2 is producing to target topic then I am seeing "java.security.cert.CertificateException: No subject alternative names present" error.

 Tasks:
      Id:     0
      State:  FAILED
      Trace:  org.apache.kafka.connect.errors.ConnectException: Unrecoverable exception from producer send callback
              at org.apache.kafka.connect.runtime.WorkerSourceTask.maybeThrowProducerSendException(WorkerSourceTask.java:312)
              at org.apache.kafka.connect.runtime.WorkerSourceTask.prepareToSendRecord(WorkerSourceTask.java:126)
              at org.apache.kafka.connect.runtime.AbstractWorkerSourceTask.sendRecords(AbstractWorkerSourceTask.java:395)
              at org.apache.kafka.connect.runtime.AbstractWorkerSourceTask.execute(AbstractWorkerSourceTask.java:354)
              at org.apache.kafka.connect.runtime.WorkerTask.doRun(WorkerTask.java:189)
              at org.apache.kafka.connect.runtime.WorkerTask.run(WorkerTask.java:244)
              at org.apache.kafka.connect.runtime.AbstractWorkerSourceTask.run(AbstractWorkerSourceTask.java:72)
              at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
              at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
              at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
              at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
              at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative names present
  at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:371)
  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:314)
  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:309)
  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
  at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
  at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
  at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
  at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
  at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
  at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
  at org.apache.kafka.common.network.SslTransportLayer.runDelegatedTasks(SslTransportLayer.java:435)
  at org.apache.kafka.common.network.SslTransportLayer.handshakeUnwrap(SslTransportLayer.java:523)
  at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:373)
  at org.apache.kafka.common.network.SslTransportLayer.handshake(SslTransportLayer.java:293)
  at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:178)
  at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:543)
  at org.apache.kafka.common.network.Selector.poll(Selector.java:481)
  at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:560)
  at org.apache.kafka.clients.producer.internals.Sender.runOnce(Sender.java:328)
  at org.apache.kafka.clients.producer.internals.Sender.run(Sender.java:243)
  at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: java.security.cert.CertificateException: No subject alternative names present
  at java.base/sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:142)
  at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:101)
  at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:458)
  at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:432)
  at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:292)
  at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
  ... 19 more

Please suggest any fix.

[scholzj]

Can you format it as a code so that it is readable?

[scholzj]

In the log, it seems to be set everywhere correctly. But the error is not there -> so maybe the issue did not happened yet.

[vamshikrishnamraju]

@scholzj Please check the full log

search for javax.net.ssl.SSLHandshakeException:

[scholzj]

Have you tried to add the prefixes as I suggested? You do not seem to have that in the cluster configuration. You also masked the bootstrap address. So it is not clear which client it really is. You do not need to share the real address, but it would be good if your placeholder can distinguish whether it is the address of source or target cluster. That should give a better idea where it is missing.

[vamshikrishnamraju]

@scholzj Thank you after adding prefixes which you have suggested in the cluster configuration, it is working now. :)

[scholzj]

Great. Glad it works now.