SSL Handshake Exception between brokers when deploying confluent kafka with SSL on openshift

[himmatb]

I am doing a 3 node setup of confluent kafka on openshift with the following properties in yml. containers:

• env:
  • name: KAFKA_ADVERTISED_LISTENERS value: 'SSL://kf-1.kafka-dev.svc:9093'
  • name: KAFKA_BROKER_ID value: '1'
  • name: KAFKA_ZOOKEEPER_CONNECT value: >- zk-1.kafka-dev.svc:2181,zk-2.kafka-dev.svc:2181,zk-3.kafka-dev.svc:2181
  • name: KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR value: '1'
  • name: KAFKA_SSL_CLIENT_AUTH value: none
  • name: KAFKA_SSL_KEYSTORE_CREDENTIALS value: keystore_pass1
  • name: KAFKA_SSL_KEYSTORE_FILENAME value: kafka_keystore1
  • name: KAFKA_SSL_KEY_CREDENTIALS value: key_pass1
  • name: KAFKA_SSL_TRUSTSTORE_CREDENTIALS value: truststore_pass1
  • name: KAFKA_SSL_TRUSTSTORE_FILENAME value: kafka_trustore1
  • name: KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM
  • name: KAFKA_SECURITY_INTER_BROKER_PROTOCOL value: SSL
  • name: KAFKA_SSL_KEYSTORE_TYPE value: JKS
  • name: KAFKA_SSL_TRUSTSTORE_TYPE value: JKS
  • name: KAFKA_SECURITY_PROTOCOL value: SSL

I am getting the following exception while trying to test the same with SSL enabled between the brokers.

[2018-12-25 14:33:35,961] WARN [RequestSendThread controllerId=1] Controller 1's connection to broker kf-3.kafka-dev.svc:9093 (id: 3 rack: null) was unsuccessful (kafka.controller.RequestSendThread) org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed Caused by: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?

Things work well when I am running using plain text but when I enable SSL I end up with the above issue.

I have created the certificate with CN=*.mydomainname as we are using the same certificate for all the brokers.

As we are using openshift every time a new deployment is made or a property is updated a new container is launched with a new hostname hence I cannot keep the fully qualified hostname while creating the certificate.

Any help would be appreciated.

[eddideku]

I am experiencing the same issue with the Confluent documentation. Have you found a way to resolve this?

When you created the cert, with the wildcard did you use openssl or keytool?