Strimzi
-
|
Hi, we are running kafka cluster deployed with strimzi operator on Azure AKS cluster. When I use this truststore.jks in my offset explorer, im getting SSL Handshake error : DEBUG LOG : Here is Kafka config : Here is Kafka user : Here is Listeners config : Here is ingress for for external access : Generated Secret for external-connect(KafkaUser) : Nginx controller config : have enabled ssl-passtrough on nginx controller, and i also have(hopefully) correct annotations on my ingress resource : I found this issue : https://github.com/orgs/strimzi/discussions/8121 , it seems to be related, so I think there is issue with ingress in some way, unfortunately nginx for azure does not have same annotations as mentioned in issue 8121, here is list of annotations for azure : Any help is much appreciated. Thank you. EDIT: this is giving me result of : |
Beta Was this translation helpful? Give feedback.
Answered by
scholzj
Nov 26, 2023
Replies: 4 comments 5 replies
-
|
I think To trigger the TLS-SNI mechanism used. There is one other thing that is wrong. You have this in the listener configuration: brokerCertChainAndKey:
certificate: user.crt
key: user.key
secretName: external-connectThat tells the operator that this listener should use a custom server certificate that you provide in the secret. Not sure where you got this certificate, but you should use what ever signed this or the |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
When i deleted : from kafka resource , and i used ca.crt for truststore, im still getting SSL handshake error, when i tried to use this brokercertchain and instead of ca.crt i used user.crt, i still received SSL handshake error However what i noticed is , that when i removed this brokerCertChainAndKey: and used ca.crt, Offset Explorer DEBUG logs are : there is not : anymore |
Beta Was this translation helpful? Give feedback.
2 replies
-
|
I think start is to use the OpenSSL client and see what certificates are you getting. If you removed the custom listener certificate, then the truststore should be in general good. You of course also have to configure it correctly in the client. |
Beta Was this translation helpful? Give feedback.
-
|
You could also use in the Java client the systme propert |
Beta Was this translation helpful? Give feedback.
-
|
I can see this in my kafka server logs every time when i try to authenticate with my client this log : (172.26.3.94 is address of my nginx controller) When I tried to open https://bootstrap.kafka.xxx.local from my browser I can see 2 certs in this chain: Content of cert1 : Content of cert2: |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
So, what OpenSSL gives you looks good to me. It suggests the broker uses the right certificate and the TLS passthrough works fine. So the next part is to look into the Kafka client. The command you used to create the truststore on the beginning looked fine. But you should be able to doublecheck that it has the right CA. And you should check the Java client really uses it. |
Beta Was this translation helpful? Give feedback.
-
|
Here is full log from kafka client with enabled -Djavax.net.debug=ssl : When Im creating truststore, im using content of this ca.crt from Kafka Resource : Content of ca.crt is matching with ca.crt from xxx-cluster-cluster-ca-crt : I think that client is using correct data : EDIT: But later it says : |
Beta Was this translation helpful? Give feedback.
2 replies
-
|
Well, this looks like a different error now. It is not |
Beta Was this translation helpful? Give feedback.
Answer selected by
roman5595
-
|
You are correct, that was issue, I tried this in the beginning, but it didnt work because of this : With these commands I was able to successfully connect : One note, I had to use keytool full path from windows, for some reason when i tried to use keytool on linux it always said that password is incorrect. Thank you very much! |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Well, this looks like a different error now. It is not
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targetanymore. It is nowHandshake message sequence violation, 2. That is because you configured TLS client authentication on your listener, but do not have the keystore with the user certificate defined in the client configuration. You have to create theKafkaUSerresource, take its certificates and use them as a keystore for the authentication in your Kafka client. (or disable the authentication in the listener of course, which is less secure, but an option as well)