$ keytool -keystore server.keystore.jks -alias localhost -validity {validity} -genkey
+
+ You need to specify two parameters in the above command:
+ + Therefore, it is important to prevent forged certificates by signing them for each machine in the cluster. A certificate authority (CA) is responsible for signing certificates. CA works likes a government that issues passports—the government stamps (signs) each passport so that the passport becomes difficult to forge. Other governments verify the stamps to ensure the passport is authentic. Similarly, the CA signs the certificates, and the cryptography guarantees that a signed certificate is computationally difficult to forge. Thus, as long as the CA is a genuine and trusted authority, the clients have high assurance that they are connecting to the authentic machines. +
openssl req -new -x509 -keyout ca-key -out ca-cert -days 365+ + The generated CA is simply a public-private key pair and certificate, and it is intended to sign other certificates.
keytool -keystore server.truststore.jks -alias CARoot -import -file ca-cert+ + Note: If you configure Kafka brokers to require client authentication by setting ssl.client.auth to be "requested" or "required" on Kafka broker config then you must provide a truststore for kafka broker as well and it should have all the CA certificates that clients keys signed by. +
keytool -keystore client.truststore.jks -alias CARoot -import -file ca-cert+ + In contrast to the keystore in step 1 that stores each machine’s own identity, the truststore of a client stores all the certificates that the client should trust. Importing a certificate into one’s truststore also means that trusting all certificates that are signed by that certificate. As the analogy above, trusting the government (CA) also means that trusting all passports (certificates) that it has issued. This attribute is called the chains of trust, and it is particularly useful when deploying SSL on a large Kafka cluster. You can sign all certificates in the cluster with a single CA, and have all machines share the same truststore that trusts the CA. That way all machines can authenticate all other machines.
keytool -keystore server.keystore.jks -alias localhost -certreq -file cert-file+ + Then sign it with the CA: +
openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-signed -days {validity} -CAcreateserial -passin pass:{ca-password}
+
+ Finally, you need to import both the certificate of the CA and the signed certificate into the keystore:
+ + $ keytool -keystore server.keystore.jks -alias CARoot -import -file ca-cert + $ keytool -keystore server.keystore.jks -alias localhost -import -file cert-signed ++ + The definitions of the parameters are the following: +
+ #!/bin/bash + #Step 1 + keytool -keystore server.keystore.jks -alias localhost -validity 365 -genkey + #Step 2 + openssl req -new -x509 -keyout ca-key -out ca-cert -days 365 + keytool -keystore server.truststore.jks -alias CARoot -import -file ca-cert + keytool -keystore client.truststore.jks -alias CARoot -import -file ca-cert + #Step 3 + keytool -keystore server.keystore.jks -alias localhost -certreq -file cert-file + openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-signed -days 365 -CAcreateserial -passin pass:test1234 + keytool -keystore server.keystore.jks -alias CARoot -import -file ca-cert + keytool -keystore server.keystore.jks -alias localhost -import -file cert-signed +
listeners+ + If SSL is not enabled for inter-broker communication (see below for how to enable it), both PLAINTEXT and SSL ports will be necessary. +
listeners=PLAINTEXT://host.name:port,SSL://host.name:port+ + Following SSL configs are needed on the broker side +
+ ssl.keystore.location = /var/private/ssl/kafka.server.keystore.jks + ssl.keystore.password = test1234 + ssl.key.password = test1234 + ssl.truststore.location = /var/private/ssl/kafka.server.truststore.jks + ssl.truststore.password = test1234 ++ + Optional settings that are worth considering: +
security.inter.broker.protocol = SSL+ + If you want to enable any cipher suites other than the defaults that comes with JVM like the ones listed here: + https://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html you will need to install Unlimited Strength Policy files
with addresses: PLAINTEXT -> EndPoint(192.168.64.1,9092,PLAINTEXT),SSL -> EndPoint(192.168.64.1,9093,SSL)+ + To check quickly if the server keystore and truststore are setup properly you can run the following command +
openssl s_client -debug -connect localhost:9093 -tls1(Note: TLSv1 should be listed under ssl.enabled.protocols)
+ -----BEGIN CERTIFICATE-----
+ {variable sized random bytes}
+ -----END CERTIFICATE-----
+ subject=/C=US/ST=CA/L=Santa Clara/O=org/OU=org/CN=Sriharsha Chintalapani
+ issuer=/C=US/ST=CA/L=Santa Clara/O=org/OU=org/CN=kafka/emailAddress=test@test.com
+
+ If the certificate does not show up or if there are any other error messages than your keystore is not setup properly.+ security.protocol = SSL + ssl.truststore.location = "/var/private/ssl/kafka.client.truststore.jks" + ssl.truststore.password = "test1234" ++ + If client authentication is required, then a keystore must be created like in step 1 and the following must also be configured: +
+ ssl.keystore.location = "/var/private/ssl/kafka.client.keystore.jks" + ssl.keystore.password = "test1234" + ssl.key.password = "test1234" ++ Other configuration settings that may also be needed depending on our requirements and the broker configuration:\ +
+ kafka-console-producer.sh --broker-list localhost:9093 --topic test --new-producer --producer-property "security.protocol=SSL" --producer-property "ssl.truststore.location=client.truststore.jks" --producer-property "ssl.truststore.password=test1234" + + kafka-console-consumer.sh --bootstrap-server localhost:9093 --topic test --new-consumer --consumer.config client-ssl.properties ++