Supporting Multiple Client CAs with Custom type in Strimzi Kafka

[YashChauhanOfficial]

Strimzi Kafka officially supports a single Client CA through the default clients-ca-cert secret. In our testing, we were able to successfully authenticate multiple clients by adding multiple CA certificates into the separate files within the secret. like ca.crt , ca1.crt , ca2.crt

However, when using authentication.type: custom, it appears that a custom truststore with multiple trusted CAs should be possible. We are looking for guidance on how to configure this correctly.

We attempted several configurations, including:

• Adding multiple certificate files within a single secret
• Using different and multiple ssl.truststore.location paths
  configurations examples:
  Default one:

spec:
  kafka:
    listeners:
      - name: tls
        port: 9093
        tls: true
        type: internal
        authentication:
          type: custom
          sasl: false
          listenerConfig:
            ssl.client.auth: required
            ssl.principal.mapping.rules: RULE:^CN=(.*?),(.*)$/CN=$1/
            ssl.truststore.location: /opt/kafka/custom-authn-secrets/custom-listener-tls-9093/custom-truststore/ca.crt
            ssl.truststore.type: PEM
          secrets:
            - key: ca.crt
              secretName: custom-truststore

---

ssl.truststore.location: /opt/kafka/custom-authn-secrets/custom-listener-tls-9093/custom-truststore/ca.crt
            ssl.truststore.type: PEM
          secrets:
            - key: ca.crt
			  key: ca1.crt
              secretName: custom-truststore

---

ssl.truststore.location: /opt/kafka/custom-authn-secrets/custom-listener-tls-9093/custom-truststore/ca.crt
ssl.truststore.location: /opt/kafka/custom-authn-secrets/custom-listener-tls-9093/custom-truststore/ca1.crt
            ssl.truststore.type: PEM
          secrets:
            - key: ca.crt
			  key: ca1.crt
              secretName: custom-truststore

---

Few more configurations approaches.......

Unfortunately, none of these approaches worked as expected.

In our current working setup, we combined multiple client CA certificates into a single file and used it in the configuration. This allows clients signed by different CAs to authenticate successfully.

However, this approach introduces operational challenges. Managing multiple CAs in a single file makes certificate renewal and updates error-prone and difficult to maintain.

Could you please advise if there is a supported way to configure multiple custom client CAs separately (e.g., as individual files) using authentication.type: custom,to simplify management and rotation?

[scholzj]

That is not how the API works. Nor how does Kafka work.

The API has one key field, so you can use for one file. Similarly, the ssl.truststore.location field takes anyway only one file as the value. So if you had two files, you would not have a way how to configure it in Kafka.

I think you have several options:

• Use the configuration provider, such as https://github.com/strimzi/kafka-kubernetes-config-provider?tab=readme-ov-file#using-patterns to load multiple certificates for you
• Use the additional volumes to mount the Secret whcih lets you mount the whole Secret (the way you mount the Secret is anyway deprecated - see https://strimzi.io/docs/operators/latest/full/configuring.html#type-KafkaListenerAuthenticationCustom-reference)
• Prepare your Secret in a way that has one file containing all certificates (E.g. have one .crt file with all the certificates or one JKS truststore)

[YashChauhanOfficial]

Hi @scholzj ,

Thank you for the response.

Prepare your Secret in a way that has one file containing all certificates (E.g. have one .crt file with all the certificates - this approach is working fine and verified, However, this approach introduces operational challenges. Managing multiple CAs in a single file makes certificate renewal and updates error-prone and difficult to maintain.

We are aiming to adopt a configuration that supports the addition of new client CAs at runtime with minimal effort, even after Kafka has already been deployed.

In the default Strimzi setup, this is straightforward—by patching the clients-ca-cert secret and incrementing the ca-cert-generation annotation, the changes are applied automatically. We are looking for a similar, simple mechanism to manage multiple client CAs in our configuration.

Below configuration working for a single client CA, and we would like to adapt it to support multiple client CAs.

    - name: tls
      port: 9094
      type: loadbalancer
      tls: true
      authentication:
        type: custom
        sasl: false
        listenerConfig:
          ssl.client.auth: required
          ssl.principal.mapping.rules: RULE:^CN=(.*?),(.*)$/$1@my-cluster.com/
          ssl.truststore.location: /opt/kafka/custom-authn-secrets/custom-listener-tls-9094/custom-truststore/ca.crt
          ssl.truststore.type: PEM
        secrets:
          - key: ca.crt
            secretName: custom-truststore
      configuration:
        brokerCertChainAndKey:
          secretName: kafka-broker-cert
          certificate: tls.crt
          key: tls.key

[scholzj]

In the default Strimzi setup, this is straightforward—by patching the clients-ca-cert secret and incrementing the ca-cert-generation annotation, the changes are applied automatically. We are looking for a similar, simple mechanism to manage multiple client CAs in our configuration.

Please be aware that this was always rather a hack that worked by coincidence and not by intention.

Managing multiple CAs in a single file makes certificate renewal and updates error-prone and difficult to maintain.

Ok, so, as I said, you should be able to use the config provider, which can load the certificates based on a matching pattern directly from the Secret. (I think that is exactly the same as what Strimzi internally does with the Clients CA)

I do not think there is any other way then to use some config provider if you want to get multiple files into a single files loaded by Kafka. And the Strimzi Kubernetes Config provider is already bundled in the Strimzi images.