How to set SSL configurations when using keystore.jks and truststore.jks files?

[eladpf]

Hi Team,

I'm using keytool to generate my SSL certificates and therefore I'm using the following client.properties file to authenticate my clients with the Kafka server:
security.protocol=SSL
ssl.truststore.location=some_dir/truststore.jks
ssl.keystore.location=some_dir/keystore.jks
ssl.keystore.password=mypass
ssl.key.password=mypass

I need to use these properties for creating an ACL, but all the examples i've found are using PEM files generated by OpenSSL.

Please advise.

I believe you cannot use the jks (Java Key Store) files directly since they are not understood by Python, at least not easily. You can use this gist I created for extracting the three PEM files from a given JKS, and for then using them to create a KafkaConsumer object. Hope it helps :)

[bbkchdhry]

Hello @KrishnaTG

I extracted the pem files from jks as you sugested in this gist, but I still get the same error of "certificate verification failed". Also, I tried to implement the suggestion given here.

The thing is I don't get any error while using the same certificate in Java Kafka Consumer. So, is there something that I am doing wrong, please suggest. Thank you.

Here is my code and the error,

Hey @bbkchdhry can you try setting ssl_check_hostname to False and see if that helps?

[bbkchdhry]

Hi @KrishnaTG
No, it does not help, I am getting the same error.

[bbkchdhry]

Hello @KrishnaTG

The issue was due to one of my kafka nodes, so I excluded that node and as you suggested to put ssl_check_hostname to False and now it is working fine.

Thank you for you time. :)

[gursifath]

Hi @KrishnaTG @bbkchdhry,

I'm also trying to generate pem files from jks.
The code says select the valid key entry from print() and replace that with "put_key_entry_here". I have about 12 key entries. How do I know which is valid and which isn't?

[bbkchdhry]

Hi @gursifath

The code prints the list of keys (i.e. name of your alias) that are present in your jks file. You need to put the alias name, of which you want to generate pem file.

Also, there is another way using keytool command, if you want to try that too.

keytool -exportcert -alias alias_name -keystore /path/to/keystore/jks -rfc -file my_key.pem

Finally, you can view your pem certificate using,

keytool -printcert -file my_key.pem

[gursifath]

Thank you so much!

[akkinepally]

Hi @KrishnaTG @bbkchdhry
Even after converting the JKS file to pem files, I am getting
SSL: CERTIFICATE_VERIFY_FAILED

[matejsoroka]

I would say that the library should be able to use .jks keys and do the extraction.

[bbkchdhry]

Hi @KrishnaTG @bbkchdhry
Even after converting the JKS file to pem files, I am getting
SSL: CERTIFICATE_VERIFY_FAILED

Were you able to solve the issue ?

[dpkp]

Use ssl_context configuration parameter to solve this issue.