After reading this documentation: http://kafka.apache.org/documentation.html#security_ssl I was able to set up Kafka using SSL with a self-signed certificate.

I tried setting it up with a Digicert certificate, and it can present the certificate, but doesn't present the intermediate.

I wasn't able to find any documentation around using a certificate chain/intermediate certificates with Kafka, so I do not know if this is actually possible.

My keystore looks like this:

$ keytool -list -keystore star_dev.keystore
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

intermediateca, 18-May-2018, trustedCertEntry,
Certificate fingerprint (SHA1): 1F:B8:6B:11:68:EC:74:31[...]
star_dev, 18-May-2018, PrivateKeyEntry,
Certificate fingerprint (SHA1): 9D:B8:05:44:B1:2D:8E:3E[...]

This is the correct answer here: https://stackoverflow.com/questions/9299133/why-doesnt-java-send-the-client-certificate-during-ssl-handshake/9300727#9300727

You create a bundle from the certificate and intermediates as follows:

cat cert.crt intermediate.crt >> bundle.crt

Then import the bundle:

keytool -importcert -keystore store.jks -alias myalias -file bundle.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.