How to connect to SSL enabled Kafka broker?

[vbartoni]

Hi,
I would appreciate some guide on how to configure the Kafka-ui to to connect to Kafka cluster that uses only SSL connections.
There are some typical parameters to be provided like

• truststore file
• keystore file
• truststore and keystore passwords

I was not able to spot parameters that could be used for configuring SSL. Is it supported?

I am planning to use Helm, but any example would do. Thanks!

[Haarolean]

Hi, could you please try checking this out?
https://github.com/provectus/kafka-ui/pull/971/files

[Haarolean]

An example is located here.

[AliBrahem]

Hello,
I'm trying to connect to AWS MSK using this example ( with SSL/TLS certificate client ) and I'm getting 2 errors :

1 - Failed to load SSL keystore /usr/java/kafka-ssl/ssl/kafka.truststore.jks of type JKS / Modification time of key store could not be obtained: /usr/java/kafka-ssl/ssl/kafka.truststore.jks

2 - Opening socket connection to server z-2.xxxx-xxxx-msk-xxxxx.xxxxx.c3.kafka.eu-west-3.amazonaws.com/X.X.X.X:2181. Will not attempt to authenticate using SASL (unknown error)

Here is my kafka-ssl.yml

`---
version: '3.4'
services:

kafka-ui:
container_name: kafka-ui
image: provectuslabs/kafka-ui:latest
ports:
- 8080:8080
depends_on:
- zookeeper0
- kafka0
environment:
KAFKA_CLUSTERS_0_NAME: msk-dev-xxxx
KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SSL
KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: b-2.xxxx-xxxx-msk-xxxx.xxxxx.c3.kafka.eu-west-3.amazonaws.com:9094 # SSL LISTENER!
KAFKA_CLUSTERS_0_ZOOKEEPER: z-2.xxxx-xxxx-msk-xxxxx.xxxxx.c3.kafka.eu-west-3.amazonaws.com:2181
KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION: /usr/java/kafka-ssl/ssl/kafka.truststore.jks
KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD: 12345678 # A FILE WITH THE TRUSTSTORE PASSWORD
volumes:
- ./ssl/kafka.truststore.jks:/kafka.truststore.jks

zookeeper0:
image: confluentinc/cp-zookeeper:6.0.1
environment:
ZOOKEEPER_CLIENT_PORT: 2181
ZOOKEEPER_TICK_TIME: 2000
ports:
- 2181:2181

kafka0:
image: confluentinc/cp-kafka:6.0.1
hostname: kafka0
depends_on:
- zookeeper0
ports:
- '9094:9094'
environment:
KAFKA_BROKER_ID: 1
KAFKA_ZOOKEEPER_CONNECT: z-2.xxxx-xxxx-msk-xxxxx.xxxxx.c3.kafka.eu-west-3.amazonaws.com:2181
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
KAFKA_ADVERTISED_LISTENERS: SSL://b-2.xxxx-xxxx-msk-xxxx.xxxxx.c3.kafka.eu-west-3.amazonaws.com:9094,PLAINTEXT_HOST://localhost:9092
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SSL:SSL,PLAINTEXT_HOST:PLAINTEXT
KAFKA_INTER_BROKER_LISTENER_NAME: SSL
KAFKA_SECURITY_PROTOCOL: SSL
KAFKA_SSL_ENABLED_MECHANISMS: PLAIN,SSL
KAFKA_SSL_KEYSTORE_FILENAME: kafka.keystore.jks
KAFKA_SSL_KEYSTORE_CREDENTIALS: creds
KAFKA_SSL_KEY_CREDENTIALS: creds
KAFKA_SSL_TRUSTSTORE_FILENAME: kafka.truststore.jks
KAFKA_SSL_TRUSTSTORE_CREDENTIALS: creds
#KAFKA_SSL_CLIENT_AUTH: 'required'
KAFKA_SSL_CLIENT_AUTH: "requested"
KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: '' # COMMON NAME VERIFICATION IS DISABLED SERVER-SIDE
volumes:
- ./ssl/creds:/etc/kafka/secrets/creds
- ./ssl/kafka.truststore.jks:/etc/kafka/secrets/kafka.truststore.jks
- ./ssl/kafka.keystore.jks:/etc/kafka/secrets/kafka.keystore.jks`

Thank you for your help.
Regards

[Haarolean]

Hi, your KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION env. variable value is invalid. You've mounted file ./ssl/kafka.truststore.jks on the host OS to /kafka.truststore.jks in a container, and that's what you should've set as a value.

[AliBrahem]

Thank you for your reply.
I tested ./kafka.truststore at first it shows me Failed to load SSL keystore /kafka.truststore.jks of type JKS and another exception Caused by: java.security.UnrecoverableKeyException: Password verification failed.
The password is stored in a file : ./ssl/creds
The second error is about kafka0 :

• Will not attempt to authenticate using SASL (unknown error)
• Unable to read additional data from server sessionid 0x0, likely server has closed socket, closing socket connection and attempting reconnect
  Will appreciate your help.
  Thanks

[Haarolean]

Yeah, sorry about the 'A FILE WITH THE TRUSTSTORE PASSWORD' comment, that's not true, it's actually a string password in this variable. The rest should work. Once you fix it, check if the second one is gone as well