Unable to produce messages to Kafka with SSL enabled

Question

I configured kafka (1.0) with SSL enabled and added listeners property as listeners=PLAINTEXT://:9092,SSL://:9093 And Advertised listeners as advertisted.listeners=PLAINTEXT://PUBLICIP:9092,SSL://PUBLICIP:9093

I am able to produce messages with 9092 port, but unable to do so on SSL enabled 9093. Below is the error I am getting

[2018-05-03 10:51:41,990] ERROR Error when sending message to topic test with key: null, value: 16 bytes with error: (org.apache.kafka.clients.producer.internals.ErrorLoggingCallback)

org.apache.kafka.common.errors.TimeoutException: Failed to update metadata after 60000 ms.

Here is the producer command I am using

bin/kafka-console-producer.sh --broker-list PUBLICIP1:9093,PUBLICIP2:9093,PUBLICIP3:9093 --topic test --property security.protocol=SSL --producer.config ~/client.properties

Here are the entries in client.properties

security.protocol=SSL
ssl.truststore.location=/home/ubuntu/kafka.client.truststore.jks
ssl.truststore.password=trustpassword

You need to enable debug logging or even ssl debug logging to proceed further here. The problem could be server side, client side, or in your certificates still. I suggest you follow a tutorial like docs.confluent.io/current/tutorials/security_tutorial.html This way you'll know if you missed any steps along the way as it looks like you are generating your own certs anyway. — dawsaw
If you think all keystores and certificates are valid and properly setup in brokers then try to add client key store along with trust store in your properties file. Also check the ssl.cipher.suites property on broker and have the same in your producer ssl properties. — suraj_fale

asolanki asolanki · Accepted Answer · 2018-11-22T08:14:32

If you use 2.0+ versions below is the command for console producer

kafka-console-producer –broker-list kafka.example.com:9093 –topic securing-kafka –producer.config /etc/kafka/producer_ssl.properties

producer_ssl.properties

bootstrap.servers=kafka.example.com:9093
security.protocol=SSL
ssl.truststore.location=/etc/security/tls/kafka.client.truststore.jks
ssl.truststore.password=test1234
ssl.keystore.location=/etc/security/tls/kafka.client.keystore.jks
ssl.keystore.password=test1234
ssl.key.password=test1234

Unable to produce messages to Kafka with SSL enabled

1 Answers