lakshmisivareddy
commented
2 years ago i am also facing the same issue
var capem = System.IO.File.ReadAllText("RootCA-SHA256.pem");
var certificatepem = System.IO.File.ReadAllText("SslCertificate.pem");
var keypem = System.IO.File.ReadAllText("SslPrivate.pem");
var consumerConfig = new ConsumerConfig()
{
BootstrapServers = _kafkaConfiguration.BootstrapServers,
SecurityProtocol = SecurityProtocol.Ssl,
GroupId = KafkaConstants.Orchestrator_CG,
SslCaLocation = _kafkaConfiguration.SslCaLocation,
//SslCaPem = capem,
//SslCertificateLocation = _kafkaConfiguration.SslCertificateLocation,
SslCertificatePem = certificatepem,
//SslKeyLocation = _kafkaConfiguration.SslKeyLocation,
SslKeyPem = keypem,
//SslKeyPassword = _kafkaConfiguration.SslKeyPassword,
AutoOffsetReset = AutoOffsetReset.Earliest,
EnableAutoCommit = true,
Debug = _kafkaConfiguration.Debug
};when i tried with setting Location it is working ,but when tried setting with Pem i am getting below Error SSL handshake failed: ssl/statem/statem_clnt.c:395: error:141A10F4:SSL routines:ossl_statem_client_read_transition:unexpected message: client SSL authentication might be required (see ssl.key.location and ssl.certificate.location and consult the broker logs for more information) (after 665ms in state SSL_HANDSHAKE, 28 identical error(s) suppressed)
edenhill
anchitj
nhaq-confluent
Description
I have a working config which uses certificates in file path (parameters SslCertificateLocation, SslKeyLocation) and I would like to switch to in-memory certificates instead. When I try to do this, I get the following error:
ssl://_kafka_url_/bootstrap: SSL handshake failed: error:1408E0F4:SSL routines:ssl3_get_message:unexpected message: client SSL authentication might be required (see ssl.key.location and ssl.certificate.location and consult the broker logs for more information) (after 130ms in state SSL_HANDSHAKE)My CRT file contains the Intermediate certificate authority and it has the following format:
My corresponding KEY file has the following format:
How to reproduce
Working example (with file path):
Not working example:
I took the content of my CRT and KEY files, put them into two variables and use the parameters SslCertificatePem and SslKeyPem. This example is not working.
I did several tests and I found that it also works with the couple SslKeyPem, SslCertificateLocation parameters. So, it seems the issue is only with the SslCertificatePem parameter and I guess it is related to the Intermediate Certificate Authority wich is inside my CRT file.
But what I don't understand is why it works with the file path and why it doesn't work with the in-memory version.
Checklist
Please provide the following information: