Some background. I'm trying to connect to Confluents Kafka Clound using the .NET driver, internally that uses the native RdKafka machinery.

From my machine, the connection fails with a

rdkafka#producer-1| [thrd:sasl_ssl://url_to_cluster: sasl_ssl://url_to_bootstrap: SSL handshake failed: s3_clnt.c:1269: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed: (after 75ms in state CONNECT)

The client has a EnableSslCertificateVerification property and if I set that to false it all works fine.

But ignore the .NET and Kafka related info here, just background. What on my machine is involved here? Am I missing some form of certs locally?

I do have openssl installed, which afaik trusts a bunch of root certs by default.

It works fine for all coworkers, even mac users on the latest OS updates. It also works on my machine if I run it from within Docker.

What can I check to resolve this?


librdkafka does not use the OSX Keychain/store, but relies on on-disk CA certificate files. The openssl brew package extracts CA certs from the store and writes them to disk on installation, so either install openssl through homebrew or grab cacert.pem from Mozilla/curl and then specify SslCaLocation to where you stored it.


You need to have installed the CA certificate that the server's TLS certificate was signed with. You didn't provide that information, but you can check the server's configuration easily enough, e.g.:

openssl s_client -connect <server>:<port> -showcerts
  • I'm feeling extremely dense here, what do I do with this information then? – Roger Johansson Sep 3 '20 at 17:19
  • You locate the CA certificate and install it on your computer. – Michael Hampton Sep 3 '20 at 17:51
  • Adding that CA as a system cert in the Mac Keychain does not change the issue above. could it be that librdkafka ignores the keychain and uses some other store instead? – Roger Johansson Sep 3 '20 at 18:42
  • @RogerJohansson That's quite possible. You should consult its documentation. – Michael Hampton Sep 3 '20 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.