[jira] [Commented] (KAFKA-13372) failed authentication due to: SSL handshake failed
[
https://issues.apache.org/jira/browse/KAFKA-13372?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17428084#comment-17428084
]
Piotr Smolinski commented on KAFKA-13372:
-
Try checking the TLS server endpoint with OpenSSL.
Get the full presented server certificate chain:
openssl s_client -connect
[kafka-broker-princial.mydomain.com|http://kafka-broker-princial.mydomain.com/]:9094
-showcerts http://kafka-broker-princial.mydomain.com/]:9094
failed authentication due to: SSL handshake failed
> --
>
> Key: KAFKA-13372
> URL: https://issues.apache.org/jira/browse/KAFKA-13372
> Project: Kafka
> Issue Type: Bug
> Components: clients
>Affects Versions: 2.2.2
>Reporter: Maria Isabel Florez Rodriguez
>Priority: Major
>
> Hi everyone,
>
> I have the next issue about authentication SCRAM + SSL. I’m using the CLI and
> this is the version of my client (./kafka_2.13-2.8.1/bin/kafka-topics.sh). In
> this example I will talk about list topics, but another operations (consumer,
> producer) failed too.
>
>
> First, let me describe the current scenario:
>
> * I have 5 Kafka servers with
> * kafka-broker-0.mydomain.com
> * kafka-broker-1.mydomain.com
> * kafka-broker-2.mydomain.com
> * kafka-broker-3.mydomain.com
> * kafka-broker-4.mydomain.com
>
> * I have a DNS principal configured with Round Robin to IPs broker:
> * kafka-broker-princial.mydomain.com (Round Robin)
>
> I have configured for each broker the next listeners (I'm using 3 ports):
> {quote}advertised.listeners=SASL_SSL://kafka-broker-0.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-0.mydomain.com:9093,PLAINTEXT://kafka-broker-0.mydomain.com:9092{quote}
> * 9092 for PLAINTEXT
> * 9093 for SASL_PLAINTEXT
> * 9094 for SASL_SSL
>
> My Kafka broker servers have the next config server.properties:
> {quote}advertised.listeners=SASL_SSL://kafka-broker-X.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-X.mydomain.com:9093,PLAINTEXT://kafka-broker-X.mydomain.com:9092
> authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
> auto.create.topics.enable=false
> auto.leader.rebalance.enable=true
> background.threads=10
> broker.id=X
> broker.rack=us-east-1c
> compression.type=producer
> connections.max.idle.ms=270
> controlled.shutdown.enable=true
> delete.topic.enable=true
> host.name=localhost
> leader.imbalance.check.interval.seconds=300
> leader.imbalance.per.broker.percentage=10
> listeners=SASL_SSL://0.0.0.0:9094,SASL_PLAINTEXT://0.0.0.0:9093,PLAINTEXT://0.0.0.0:9092
> log.cleaner.enable=true
> log.dirs=/var/lib/kafka/log/data1,/var/lib/kafka/log/data2,/var/lib/kafka/log/data3
> log.retention.check.interval.ms=30
> log.retention.hours=336
> log.segment.bytes=1073741824
> message.max.bytes=112
> min.insync.replicas=2
> num.io.threads=8
> num.network.threads=3
> num.partitions=3
> num.recovery.threads.per.data.dir=1
> num.replica.fetchers=1
> offset.metadata.max.bytes=4096
> offsets.commit.timeout.ms=5000
> offsets.retention.minutes=129600
> offsets.topic.num.partitions=50
> offsets.topic.replication.factor=3
> port=9092
> queued.max.requests=500
> replica.fetch.min.bytes=1
> replica.fetch.wait.max.ms=500
> sasl.enabled.mechanisms=SCRAM-SHA-256,GSSAPI
> sasl.kerberos.service.name=x
> sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256
> security.inter.broker.protocol=SASL_SSL
> socket.receive.buffer.bytes=102400
> socket.request.max.bytes=104857600
> socket.send.buffer.bytes=102400
> ssl.client.auth=required
> {{ssl.endpoint.identification.algorithm=""}}
> ssl.enabled.protocols=TLSv1.2
> ssl.key.password=
> ssl.keystore.location=/etc/ssl/default_keystore.jks
> ssl.keystore.password=
> ssl.truststore.location=/usr/lib/jvm/java-11-adoptopenjdk-hotspot/lib/security/cacerts
> ssl.truststore.password=
> ssl.truststore.type=JKS
> super.users=User:x
> zookeeper.connect=kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com
> :2181,kafka-zk-X.mydomain.com:218/my-environment
> zookeeper.connection.timeout.ms=6000
> zookeeper.sasl.client=false{quote}
>
>
> I was trying the next things:
>
> * (/)*PLAINTEXT:* I can consume directly to broker to broker with port
> *9092* (Using IP or dns broker)
> * (/)*PLAINTEXT:* I also can consume directly to DNS principal configured
> with Round Robin with port *9092* (Using DNS principal)
> * (/)*SASL_SSL:* I can consume directly to broker to broker with port *9094*
> (Using only dns broker due it needs to validate the certificate)
> * (x)*SASL_SSL:* I cannot consume directly to DNS principal configured with
> Round Robin with port *9094*
> The issue is: * *(x)SASL_SSL(x):* I cannot consume directly to DNS principal
> configured with Round Robin with port *9094*. Only I
[jira] [Commented] (KAFKA-13372) failed authentication due to: SSL handshake failed
[
https://issues.apache.org/jira/browse/KAFKA-13372?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17428962#comment-17428962
]
Maria Isabel Florez Rodriguez commented on KAFKA-13372:
---
Hi Piotr!
Thanks a lot. You're right. I was reviewing my broker's certificates and I had
to add as alternate name my main DNS on each broker. Now it works.
Have nice day!
@maisfloro
> failed authentication due to: SSL handshake failed
> --
>
> Key: KAFKA-13372
> URL: https://issues.apache.org/jira/browse/KAFKA-13372
> Project: Kafka
> Issue Type: Bug
> Components: clients
>Affects Versions: 2.2.2
>Reporter: Maria Isabel Florez Rodriguez
>Priority: Major
>
> Hi everyone,
>
> I have the next issue about authentication SCRAM + SSL. I’m using the CLI and
> this is the version of my client (./kafka_2.13-2.8.1/bin/kafka-topics.sh). In
> this example I will talk about list topics, but another operations (consumer,
> producer) failed too.
>
>
> First, let me describe the current scenario:
>
> * I have 5 Kafka servers with
> * kafka-broker-0.mydomain.com
> * kafka-broker-1.mydomain.com
> * kafka-broker-2.mydomain.com
> * kafka-broker-3.mydomain.com
> * kafka-broker-4.mydomain.com
>
> * I have a DNS principal configured with Round Robin to IPs broker:
> * kafka-broker-princial.mydomain.com (Round Robin)
>
> I have configured for each broker the next listeners (I'm using 3 ports):
> {quote}advertised.listeners=SASL_SSL://kafka-broker-0.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-0.mydomain.com:9093,PLAINTEXT://kafka-broker-0.mydomain.com:9092{quote}
> * 9092 for PLAINTEXT
> * 9093 for SASL_PLAINTEXT
> * 9094 for SASL_SSL
>
> My Kafka broker servers have the next config server.properties:
> {quote}advertised.listeners=SASL_SSL://kafka-broker-X.mydomain.com:9094,SASL_PLAINTEXT://kafka-broker-X.mydomain.com:9093,PLAINTEXT://kafka-broker-X.mydomain.com:9092
> authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
> auto.create.topics.enable=false
> auto.leader.rebalance.enable=true
> background.threads=10
> broker.id=X
> broker.rack=us-east-1c
> compression.type=producer
> connections.max.idle.ms=270
> controlled.shutdown.enable=true
> delete.topic.enable=true
> host.name=localhost
> leader.imbalance.check.interval.seconds=300
> leader.imbalance.per.broker.percentage=10
> listeners=SASL_SSL://0.0.0.0:9094,SASL_PLAINTEXT://0.0.0.0:9093,PLAINTEXT://0.0.0.0:9092
> log.cleaner.enable=true
> log.dirs=/var/lib/kafka/log/data1,/var/lib/kafka/log/data2,/var/lib/kafka/log/data3
> log.retention.check.interval.ms=30
> log.retention.hours=336
> log.segment.bytes=1073741824
> message.max.bytes=112
> min.insync.replicas=2
> num.io.threads=8
> num.network.threads=3
> num.partitions=3
> num.recovery.threads.per.data.dir=1
> num.replica.fetchers=1
> offset.metadata.max.bytes=4096
> offsets.commit.timeout.ms=5000
> offsets.retention.minutes=129600
> offsets.topic.num.partitions=50
> offsets.topic.replication.factor=3
> port=9092
> queued.max.requests=500
> replica.fetch.min.bytes=1
> replica.fetch.wait.max.ms=500
> sasl.enabled.mechanisms=SCRAM-SHA-256,GSSAPI
> sasl.kerberos.service.name=x
> sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256
> security.inter.broker.protocol=SASL_SSL
> socket.receive.buffer.bytes=102400
> socket.request.max.bytes=104857600
> socket.send.buffer.bytes=102400
> ssl.client.auth=required
> {{ssl.endpoint.identification.algorithm=""}}
> ssl.enabled.protocols=TLSv1.2
> ssl.key.password=
> ssl.keystore.location=/etc/ssl/default_keystore.jks
> ssl.keystore.password=
> ssl.truststore.location=/usr/lib/jvm/java-11-adoptopenjdk-hotspot/lib/security/cacerts
> ssl.truststore.password=
> ssl.truststore.type=JKS
> super.users=User:x
> zookeeper.connect=kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com:2181,kafka-zk-X.mydomain.com
> :2181,kafka-zk-X.mydomain.com:218/my-environment
> zookeeper.connection.timeout.ms=6000
> zookeeper.sasl.client=false{quote}
>
>
> I was trying the next things:
>
> * (/)*PLAINTEXT:* I can consume directly to broker to broker with port
> *9092* (Using IP or dns broker)
> * (/)*PLAINTEXT:* I also can consume directly to DNS principal configured
> with Round Robin with port *9092* (Using DNS principal)
> * (/)*SASL_SSL:* I can consume directly to broker to broker with port *9094*
> (Using only dns broker due it needs to validate the certificate)
> * (x)*SASL_SSL:* I cannot consume directly to DNS principal configured with
> Round Robin with port *9094*
> The issue is: * *(x)SASL_SSL(x):* I cannot consume directly to DNS principal
> configured with Round Robin with port *9094*. Only I have the issue with I
> try to connect directly to DNS pr
