connecting to on-prem schema registry with self-signed certificate

[CurryWurry]

We are running an on-prem Confluent schema registry, but when trying to get subjects we get: "Error: CompletionException: io.streamthoughts.jikkou.http.client.RestClientException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"

configuring ssl and connecting to the kafka brokers works without any issues. Adding the schema registry's self signed certificate to the JDK's truststore did not work. Are ssl properties evaluated in the jikkou.schemaRegistry namespace? Looking at the documentation we can only specify url, vendor, authMethod and basic auth properties.

[fhussonnois]

Hi @CurryWurry, I think that for the SSL Authentication is not support by Jikkou. Are you using a Schema Registry configured with ssl.client.auth=true (confluent doc: https://docs.confluent.io/platform/current/schema-registry/security/index.html#additional-configurations-for-https). I will push a PR so that you will be able to configure the ssl properties for the schema registry.

[CurryWurry]

Hi @fhussonnois , yes, we have configured schemaRegistry exactly like we did for the kafka client, but these properties are indeed ignored for both schemaRegistry and kafkaConnect. We managed to temporarily work around this limitation by providing JVM parameters to the Jikkou cli: jikkou -Djavax.net.ssl.keyStore=./pre-prod/keystore.p12 ... get sr

[fhussonnois]

Hi @CurryWurry, you should be able to evaluate the early-access release which contains the new feature for configuring both Kafka Connect and Schema Registry with SSL.

Example:

jikkou  {
  schemaRegistry {
    url = "https://localhost:8081"
    authMethod = "SSL"
    sslKeyStoreLocation = "/certs/registry.keystore.jks"
    sslKeyStoreType = "JKS"
    sslKeyStorePassword = "password"
    sslKeyPassword = "password"
    sslTrustStoreLocation = "/certs/registry.truststore.jks"
    sslTrustStoreType = "JKS"
    sslTrustStorePassword = "password"
    sslIgnoreHostnameVerification = true
  }
}