AKHQ SSL Issue on Openshift #893
Answered
by
tchiotludo
jains20171
asked this question in
Q&A
-
|
Hi, I am running AKHQ using a docker image that I built on Openshift 4.7 using AKHQ Jar (Rel.0.18.0). I am connecting to my kafka cluster using SSL certificate generated by Strimzi on Openshift. The application comes up and shows the Kafka topics etc. After some time i am getting SSL handshake errors from the admin client and the application becomes inoperational. Below is my configuration and the error message. Also attaching one full Config: logger:
levels:
root: DEBUG
micronaut:
server:
context-path: /akhq
security:
enabled:false
akhq:
security:
default-group: reader
connections:
dev:
properties:
bootstrap.servers: secure-esp-dev-cluster-kafka-tls-bootstrap-strimzi-dev.apps.cbercss.preprod.fda.gov:443
security.protocol: SASL_SSL
ssl.truststore.location: /tmp/cluster-jks-certs/ca.jks
ssl.truststore.password: <some pswd>
ssl.truststore.type: JKS
ssl.endpoint.identification.algorithm: ""
sasl.mechanism: SCRAM-SHA-512
sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="userid" password="pswd";
adminclient.security.protocol: SASL_SSLError: |
Beta Was this translation helpful? Give feedback.
Answered by
tchiotludo
Oct 29, 2021
Replies: 5 comments
-
|
forgot to mention we are on java 11 and Strimzi 0.25 and kafka 2.8 |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
not really sure, but as I understand the stacktrace, the jks is not valid for this hostname :
Some command to understand the issue : keytool -printcert -v -file mydomain.crt
keytool -list -v -keystore keystore.jks
keytool -list -v -keystore cacerts.jks |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
I had to convert the PKCS12 certificate(generated by Strimzi) to JKS because the application gave me an error with PKCS12 certificate type. I can send you that message if needed. Here is output of commands you mentioned. 1. 2. 3 Let me know if you need more information. Thanks for your help |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Ok seems to be a valid jks. akhq:
connections:
ssl-dev:
properties:
bootstrap.servers: "{{host}}.aivencloud.com:12835"
security.protocol: SSL
ssl.truststore.location: {{path}}/avnadmin.truststore.jks
ssl.truststore.password: {{password}}
ssl.keystore.type: "PKCS12"
ssl.keystore.location: {{path}}/avnadmin.keystore.p12
ssl.keystore.password: {{password}}
ssl.key.password: {{password}}I'm not an expert of kafka ssl, but I never see a connection without |
Beta Was this translation helpful? Give feedback.
0 replies
Answer selected by
tchiotludo
-
|
Thanks for your feedback. keystore is required if you are doing two way TLS authentication. For us it is important that the traffic in flight is encrypted, which truststore SSL is doing for us. At this time I believe I will just add my SSL certificate to the java cacerts store and hopefully the error will go away. I will keep you posted |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Ok seems to be a valid jks.
One thing I didn't mention, you don't provide client in the configuration :
I'm not an expert of kafka ssl, but I never see a connection without
ssl.keystore.type?