Hi, I’d like to start a discussion on a KIP to improve public Certificate Authorities (CA) compatibility after public CAs are actively deprecating and will soon stop providing multipurpose certificates. This presents a breaking operational challenge for Kafka environments relying on public CAs. A Kafka broker is simultaneously a TLS server (it accepts connections on its listeners) and a TLS client (it dials other brokers and controllers). With a single keystore, the same certificate is presented in both roles.
https://cwiki.apache.org/confluence/spaces/KAFKA/pages/430408110/KIP-1354+Single+purpose+TLS+extended+key+usages+EKU+support Thanks, Berci
