Debugging process for Kafka SSL security

Question

I was able to set up the SSL in my Kafka brokers and client and I am also able to see that when we produce messages using the 9093 port that is the SSL port the messages are consumed by the consumer.

I tried to send a message via the 9093 port and the message is sent to the consumer from the producer.

Is there any way to verify if this is actually working, I mean how can I demonstrate that 9092 is not SSL and 9093 is SSL and secured?

Answer 1

Below two ways can verify the setup of SSL.

1. -Djavax.net.debug=all Add this property in bin/kafka-run-class.sh at the same place as:

   if [ -z "$KAFKA_JMX_OPTS" ]; then
       KAFKA_JMX_OPTS="  <**add here**>  -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false  -Dcom.sun.management.jmxremote.ssl=false "
   fi
   

   then tail the kafka broker log file, you should see some encoded messages.

2. To verify if the server's keystore and truststore are setup correctly you can run the following command:

   openssl s_client -debug -connect localhost:9093 -tls1
   

   Note: TLSv1 should be listed under ssl.enabled.protocols.

   In the output of this command you should see the server’s certificate:

   -----BEGIN CERTIFICATE-----
   {variable sized random bytes}
   -----END CERTIFICATE-----
   subject=/C=US/ST=CA/L=Santa Clara/O=org/OU=org/CN=Joe Smith
   issuer=/C=US/ST=CA/L=Santa Clara/O=org/OU=org/CN=kafka/[email protected]
   

   If the certificate does not show up or if there are any other error messages then your keystore is not setup correctly.

Reference :

1. http://docs.confluent.io/2.0.0/kafka/ssl.html
2. https://github.com/Symantec/kafka-security-0.9