Strimzi upgrade 0.48.0 to 0.51.0 : kafkaconnect ssh Failure with cluster kafka confluent 7.9.0 (kafka 3.9.0)

[lmo-34]

We are using strimzi kafkaconnector, operator 0.48.0, to connect a Kafka cluster confluent 7.9.0 (Kafka 3.9.0).

After upgrading operator to 0.51.0, we are facing this issue :
{"timestamp":"2026-07-28T08:36:35.370Z","level":"ERROR","logger":"org.apache.kafka.clients.NetworkClient","message":"[AdminClient clientId=adminclient-1] Connection to node -1 (so101-wave-tis-kafka.z1-dev.k8s.pole-emploi.intra/10.201.176.30:443) failed authentication due to: SSL handshake failed","thread":"kafka-admin-client-thread | adminclient-1","service":"kafka-connect"}

Is there an incompatibility between Kafkaconnet 0.51.0 and Kafka 3.9.0 ?

[scholzj]

I don't think there should be any compatibility issue. This is liely just some configuration issue in how you configured the TLS. But hard to say more without the full configurations, logs, etc.

[lmo-34]

I've attached zip kakaconnect yaml and log file
v0.51.0.zip

[scholzj]

I'm not 100% sure about the exact issue without having a reproducer environment. But I wonder if this section is causing some issues:

  jvmOptions:
    javaSystemProperties:
    - name: javax.net.ssl.trustStore
      value: /mnt/trusted-ca-jks/pe.jks
    - name: javax.net.ssl.trustStorePassword
      value: $(TRUSTSTORE_PASSWORD)

First of all, it is complaining that it is not readable:

2026-07-28 08:36:33.763  INFO   [main] CertUtils - There is a problem with reading default keystore/truststore file /mnt/trusted-ca-jks/pe.jks - the file won't be loaded. The reason is: Keystore was tampered with, or password was incorrect

Second I wonder if it interferes with the TLS configuration set up by Strimzi.

[lmo-34]

We removed unnecessary certificates from the truststore and reorganised its contents, and it’s working again.

Thanks for your help.