[jira] [Commented] (KAFKA-13372) failed authentication due to: SSL handshake failed
[ https://issues.apache.org/jira/browse/KAFKA-13372?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17428084#comment-17428084 ] Piotr Smolinski commented on KAFKA-13372: - Try checking the TLS server endpoint with OpenSSL. Get the full presented server certificate chain: openssl s_client -connect [kafka-broker-princial.mydomain.com|http://kafka-broker-princial.mydomain.com/]:9094 -showcerts http://kafka-broker-princial.mydomain.com/]:9094 failed authentication due to: SSL handshake failed > -- > > Key: KAFKA-13372 > URL: https://issues.apache.org/jira/browse/KAFKA-13372 > Project: Kafka > Issue Type: Bug > Components: clients >Affects Versions: 2.2.2 >Reporter: Maria Isabel Florez Rodriguez >Priority: Major > > Hi everyone, > > I have the next issue about authentication SCRAM + SSL. I’m using the CLI and > this is the version of my client (./kafka_2.13-2.8.1/bin/kafka-topics.sh). In > this example I will talk about list topics, but another operations (consumer, > producer) failed too. > > > First, let me describe the current scenario: > > * I have 5 Kafka servers with > * kafka-broker-0.mydomain.com > * kafka-broker-1.mydomain.com > * kafka-broker-2.mydomain.com > * kafka-broker-3.mydomain.com > * kafka-broker-4.mydomain.com > > * I have a DNS principal configured with Round Robin to IPs broker: > * kafka-broker-princial.mydomain.com (Round Robin) > > I have configured for each broker the next listeners (I'm using 3 ports): > {quote}advertised.listeners=SASL_SSL://kafka-broker-0.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-0.mydomain.com:9093,PLAINTEXT://kafka-broker-0.mydomain.com:9092{quote} > * 9092 for PLAINTEXT > * 9093 for SASL_PLAINTEXT > * 9094 for SASL_SSL > > My Kafka broker servers have the next config server.properties: > {quote}advertised.listeners=SASL_SSL://kafka-broker-X.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-X.mydomain.com:9093,PLAINTEXT://kafka-broker-X.mydomain.com:9092 > authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer > auto.create.topics.enable=false > auto.leader.rebalance.enable=true > background.threads=10 > broker.id=X > broker.rack=us-east-1c > compression.type=producer > connections.max.idle.ms=270 > controlled.shutdown.enable=true > delete.topic.enable=true > host.name=localhost > leader.imbalance.check.interval.seconds=300 > leader.imbalance.per.broker.percentage=10 > listeners=SASL_SSL://0.0.0.0:9094,SASL_PLAINTEXT://0.0.0.0:9093,PLAINTEXT://0.0.0.0:9092 > log.cleaner.enable=true > log.dirs=/var/lib/kafka/log/data1,/var/lib/kafka/log/data2,/var/lib/kafka/log/data3 > log.retention.check.interval.ms=30 > log.retention.hours=336 > log.segment.bytes=1073741824 > message.max.bytes=112 > min.insync.replicas=2 > num.io.threads=8 > num.network.threads=3 > num.partitions=3 > num.recovery.threads.per.data.dir=1 > num.replica.fetchers=1 > offset.metadata.max.bytes=4096 > offsets.commit.timeout.ms=5000 > offsets.retention.minutes=129600 > offsets.topic.num.partitions=50 > offsets.topic.replication.factor=3 > port=9092 > queued.max.requests=500 > replica.fetch.min.bytes=1 > replica.fetch.wait.max.ms=500 > sasl.enabled.mechanisms=SCRAM-SHA-256,GSSAPI > sasl.kerberos.service.name=x > sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256 > security.inter.broker.protocol=SASL_SSL > socket.receive.buffer.bytes=102400 > socket.request.max.bytes=104857600 > socket.send.buffer.bytes=102400 > ssl.client.auth=required > {{ssl.endpoint.identification.algorithm=""}} > ssl.enabled.protocols=TLSv1.2 > ssl.key.password= > ssl.keystore.location=/etc/ssl/default_keystore.jks > ssl.keystore.password= > ssl.truststore.location=/usr/lib/jvm/java-11-adoptopenjdk-hotspot/lib/security/cacerts > ssl.truststore.password= > ssl.truststore.type=JKS > super.users=User:x > zookeeper.connect=kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com > :2181,kafka-zk-X.mydomain.com:218/my-environment > zookeeper.connection.timeout.ms=6000 > zookeeper.sasl.client=false{quote} > > > I was trying the next things: > > * (/)*PLAINTEXT:* I can consume directly to broker to broker with port > *9092* (Using IP or dns broker) > * (/)*PLAINTEXT:* I also can consume directly to DNS principal configured > with Round Robin with port *9092* (Using DNS principal) > * (/)*SASL_SSL:* I can consume directly to broker to broker with port *9094* > (Using only dns broker due it needs to validate the certificate) > * (x)*SASL_SSL:* I cannot consume directly to DNS principal configured with > Round Robin with port *9094* > The issue is: * *(x)SASL_SSL(x):* I cannot consume directly to DNS principal > configured with Round Robin with port *9094*. Only I
[jira] [Commented] (KAFKA-13372) failed authentication due to: SSL handshake failed
[ https://issues.apache.org/jira/browse/KAFKA-13372?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17428962#comment-17428962 ] Maria Isabel Florez Rodriguez commented on KAFKA-13372: --- Hi Piotr! Thanks a lot. You're right. I was reviewing my broker's certificates and I had to add as alternate name my main DNS on each broker. Now it works. Have nice day! @maisfloro > failed authentication due to: SSL handshake failed > -- > > Key: KAFKA-13372 > URL: https://issues.apache.org/jira/browse/KAFKA-13372 > Project: Kafka > Issue Type: Bug > Components: clients >Affects Versions: 2.2.2 >Reporter: Maria Isabel Florez Rodriguez >Priority: Major > > Hi everyone, > > I have the next issue about authentication SCRAM + SSL. I’m using the CLI and > this is the version of my client (./kafka_2.13-2.8.1/bin/kafka-topics.sh). In > this example I will talk about list topics, but another operations (consumer, > producer) failed too. > > > First, let me describe the current scenario: > > * I have 5 Kafka servers with > * kafka-broker-0.mydomain.com > * kafka-broker-1.mydomain.com > * kafka-broker-2.mydomain.com > * kafka-broker-3.mydomain.com > * kafka-broker-4.mydomain.com > > * I have a DNS principal configured with Round Robin to IPs broker: > * kafka-broker-princial.mydomain.com (Round Robin) > > I have configured for each broker the next listeners (I'm using 3 ports): > {quote}advertised.listeners=SASL_SSL://kafka-broker-0.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-0.mydomain.com:9093,PLAINTEXT://kafka-broker-0.mydomain.com:9092{quote} > * 9092 for PLAINTEXT > * 9093 for SASL_PLAINTEXT > * 9094 for SASL_SSL > > My Kafka broker servers have the next config server.properties: > {quote}advertised.listeners=SASL_SSL://kafka-broker-X.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-X.mydomain.com:9093,PLAINTEXT://kafka-broker-X.mydomain.com:9092 > authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer > auto.create.topics.enable=false > auto.leader.rebalance.enable=true > background.threads=10 > broker.id=X > broker.rack=us-east-1c > compression.type=producer > connections.max.idle.ms=270 > controlled.shutdown.enable=true > delete.topic.enable=true > host.name=localhost > leader.imbalance.check.interval.seconds=300 > leader.imbalance.per.broker.percentage=10 > listeners=SASL_SSL://0.0.0.0:9094,SASL_PLAINTEXT://0.0.0.0:9093,PLAINTEXT://0.0.0.0:9092 > log.cleaner.enable=true > log.dirs=/var/lib/kafka/log/data1,/var/lib/kafka/log/data2,/var/lib/kafka/log/data3 > log.retention.check.interval.ms=30 > log.retention.hours=336 > log.segment.bytes=1073741824 > message.max.bytes=112 > min.insync.replicas=2 > num.io.threads=8 > num.network.threads=3 > num.partitions=3 > num.recovery.threads.per.data.dir=1 > num.replica.fetchers=1 > offset.metadata.max.bytes=4096 > offsets.commit.timeout.ms=5000 > offsets.retention.minutes=129600 > offsets.topic.num.partitions=50 > offsets.topic.replication.factor=3 > port=9092 > queued.max.requests=500 > replica.fetch.min.bytes=1 > replica.fetch.wait.max.ms=500 > sasl.enabled.mechanisms=SCRAM-SHA-256,GSSAPI > sasl.kerberos.service.name=x > sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256 > security.inter.broker.protocol=SASL_SSL > socket.receive.buffer.bytes=102400 > socket.request.max.bytes=104857600 > socket.send.buffer.bytes=102400 > ssl.client.auth=required > {{ssl.endpoint.identification.algorithm=""}} > ssl.enabled.protocols=TLSv1.2 > ssl.key.password= > ssl.keystore.location=/etc/ssl/default_keystore.jks > ssl.keystore.password= > ssl.truststore.location=/usr/lib/jvm/java-11-adoptopenjdk-hotspot/lib/security/cacerts > ssl.truststore.password= > ssl.truststore.type=JKS > super.users=User:x > zookeeper.connect=kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com > :2181,kafka-zk-X.mydomain.com:218/my-environment > zookeeper.connection.timeout.ms=6000 > zookeeper.sasl.client=false{quote} > > > I was trying the next things: > > * (/)*PLAINTEXT:* I can consume directly to broker to broker with port > *9092* (Using IP or dns broker) > * (/)*PLAINTEXT:* I also can consume directly to DNS principal configured > with Round Robin with port *9092* (Using DNS principal) > * (/)*SASL_SSL:* I can consume directly to broker to broker with port *9094* > (Using only dns broker due it needs to validate the certificate) > * (x)*SASL_SSL:* I cannot consume directly to DNS principal configured with > Round Robin with port *9094* > The issue is: * *(x)SASL_SSL(x):* I cannot consume directly to DNS principal > configured with Round Robin with port *9094*. Only I have the issue with I > try to connect directly to DNS pr