Hi Arnab, On AK5: > Listing only the local JVM’s supported groups may be misleading because Kafka > does not know the peer’s supported groups at that point.
Sorry, I meant capturing the peer’s supported groups in a custom KafkaException, not just the local supported groups. PKCS is notoriously cryptic with its error codes (with useful diagnostic messages such as “fatal_alert”, “PKIX invalid cert”/ “validation failed”) and this will be one of them. I just wonder if we could bake some useful info into the failure to help ops people get to the root a bit better. At the end of the day, if we’re following the same guarantees that the rest of the SSL suite offers, as with cipher.suites, then I’m ok with leaving this as is. -Aditya > On Oct 16, 2026, at 11:48, Arnab Nandy via dev <[email protected]> wrote: > > Listing only the local JVM’s supported groups may be misleading because Kafka > does not know the peer’s supported groups at that point.
