How does SASL_SSL security protocol work? Does client verify the server (X.509 cert)?

Question

How SSL works is well know as it's quite widely used and described well every where. In short - SSL involves

1. Verifying server authenticity by client by verifying the servers X.509 certificate.
2. Then arriving at a symmetric key using diffie-hellman key exchange algorithm.

But I am not sure what happens with security.protocol=SASL_SSL . Clients and Server communication of few technologies like Kafka etc rely on this security protocol as one of the option. Here I am worried about the point 1 above. If i get a wrong broker address (as a trick ) from some one, does SASL_SSL verify the server certificate or not is my question . If it does, then I can be sure that the received broker is not genuine and my application will not publish or subscribe to messages from this server and my data is safe.

Edit 1: Following @steffen-ullrich answer and comments And little more dig, i see below. Looks like the certificate validation is happening when used through chrome and probably its loaded in the cacerts too. So the java code is able to authenticate the server.. so seems ok..

Edit 2: Right the certificates DST and ISRG are preloaded in the JDK 11 cacerts, so the client is able to authenticate the server as commented by Stephen.

Answer 1

What you are asking is related to another configuration please read the following description.

ssl.endpoint.identification.algorithm The endpoint identification algorithm used by clients to validate server host name. The default value is https. Clients including client connections created by the broker for inter-broker communication verify that the broker host name matches the host name in the broker's certificate. Disable server host name verification by setting ssl.endpoint.identification.algorithm to an empty string. Type: string Default: https Importance: medium

Answer 2

SASL is a standard for authentication of the client - see Simple Authentication and Security Layer . SASL_SSL simply means that the client authentication (SASL) is used over a protected connection (SSL) to prevent interception instead of over a plain connection.