0

Some background. I'm trying to connect to Confluents Kafka Clound using the .NET driver, internally that uses the native RdKafka machinery.

From my machine, the connection fails with a

rdkafka#producer-1| [thrd:sasl_ssl://url_to_cluster: sasl_ssl://url_to_bootstrap: SSL handshake failed: s3_clnt.c:1269: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed: (after 75ms in state CONNECT)

The client has a EnableSslCertificateVerification property and if I set that to false it all works fine.

But ignore the .NET and Kafka related info here, just background. What on my machine is involved here? Am I missing some form of certs locally?

I do have openssl installed, which afaik trusts a bunch of root certs by default.

It works fine for all coworkers, even mac users on the latest OS updates. It also works on my machine if I run it from within Docker.

What can I check to resolve this?

1

2 Answers 2

1

librdkafka does not use the OSX Keychain/store, but relies on on-disk CA certificate files. The openssl brew package extracts CA certs from the store and writes them to disk on installation, so either install openssl through homebrew or grab cacert.pem from Mozilla/curl and then specify SslCaLocation to where you stored it.

0

You need to have installed the CA certificate that the server's TLS certificate was signed with. You didn't provide that information, but you can check the server's configuration easily enough, e.g.:

openssl s_client -connect <server>:<port> -showcerts
4
  • I'm feeling extremely dense here, what do I do with this information then? Sep 3, 2020 at 17:19
  • You locate the CA certificate and install it on your computer. Sep 3, 2020 at 17:51
  • Adding that CA as a system cert in the Mac Keychain does not change the issue above. could it be that librdkafka ignores the keychain and uses some other store instead? Sep 3, 2020 at 18:42
  • @RogerJohansson That's quite possible. You should consult its documentation. Sep 3, 2020 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .