用于模式注册表和代理的 Kafka 客户端消费者配置

Question

Following configs are in the Server Side:

For broker: listener.security.protocol.map=EXTERNAL:SASL_SSL 
kafka.rest.client.security.protocol=SASL_PLAINTEXT

For Schemaregistry:
ssl.client.auth=true
ssl.enabled.protocols=TLSv1.2
ssl.key.password=${file:/mnt/sslcerts/jksPassword.txt:jksPassword}
ssl.keystore.location=/mnt/sslcerts/keystore.jks
ssl.keystore.password=${file:/mnt/sslcerts/jksPassword.txt:jksPassword}
ssl.truststore.location=/mnt/sslcerts/truststore.jks
ssl.truststore.password=${file:/mnt/sslcerts/jksPassword.txt:jksPassword}

Broker is SASL protected and Schema Registry is mTLS protected.

I have following consumer config in my Spring Boot app.

props.put(ConsumerConfig.BOOTSTRAP_SERVERS_CONFIG, bootstrapAddress);
props.put(ConsumerConfig.KEY_DESERIALIZER_CLASS_CONFIG, KafkaJsonSchemaDeserializer.class);
props.put(ConsumerConfig.VALUE_DESERIALIZER_CLASS_CONFIG, KafkaJsonSchemaDeserializer.class);

props.put(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, "SASL_SSL");
props.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG, "TLSv1.2");

props.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, "JKS");
props.put(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG, "./certs/truststore.jks");
props.put(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG, "213fsfsK");

props.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, "JKS");
props.put(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG, "./certs/keystore.jks");
props.put(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG, "213fsfsK")

props.put(SslConfigs.SSL_ENDPOINT_IDENTIFICATION_ALGORITHM_CONFIG, sslEndpointIdentificationAlgorithm);

props.put(SaslConfigs.SASL_MECHANISM, saslMechanism);
props.put(SaslConfigs.SASL_JAAS_CONFIG, saslJaasConfig);
props.put(SaslConfigs.SASL_JAAS_CONFIG,
            String.format("%s required username=\"%s\" " + "password=\"%s\";", PlainLoginModule.class.getName(), sasl_ssl_username, sasl_ssl_password));
props.put("schema.registry.url", "https://schemaregistry.confluent.apps:443");

I am trying to configure both the security protocols in the consumer. I am getting a bad certificate error and not able to consume the messages. I just wanted to make sure I am using the right configurations so that I can be certain that the error is because of certificates.

Answer 1

I wasnt able to connect to schema registry using mTLS. So, to avoid this, I changed the schema deserializers in the JDBCConnector so that I wont have to worry about Schema Registry at all.