Kafka SSL 配置

#!/bin/bash

# 生成服務器keystore(密鑰和證書)
keytool -keystore server.keystore.jks -alias machine03.zheng.com -validity 365 -keyalg RSA -storepass leonzheng -keypass leonzheng -genkey -dname "C=CN,ST=FJ,L=FZ,O=LEON,OU=LEON,CN=ZHENG.COM"
# 生成客戶端keystore(密鑰和證書)
keytool -keystore client.keystore.jks -alias machine03.zheng.com -validity 365 -keyalg RSA -storepass leonzheng -keypass leonzheng -genkey -dname "C=CN,ST=FJ,L=FZ,O=LEON,OU=LEON,CN=ZHENG.COM"
# 建立CA證書
openssl req -new -x509 -keyout ca.key -out ca.crt -days 365 -passout pass:leonzheng -subj "/C=CN/ST=FJ/L=FZ/O=LEON/OU=LEON/CN=ZHENG.COM"
# 將CA證書導入到服務器truststore
keytool -keystore server.truststore.jks -alias CARoot -import -file ca.crt -storepass leonzheng
# 將CA證書導入到客戶端truststore
keytool -keystore client.truststore.jks -alias CARoot -import -file ca.crt -storepass leonzheng
# 導出服務器證書
keytool -keystore server.keystore.jks -alias machine03.zheng.com -certreq -file cert-file -storepass leonzheng
keytool -keystore client.keystore.jks -alias machine03.zheng.com -certreq -file client-cert-file -storepass leonzheng
# 用CA證書給服務器證書籤名
openssl x509 -req -CA ca.crt -CAkey ca.key -in cert-file -out cert-signed -days 365 -CAcreateserial -passin pass:leonzheng
openssl x509 -req -CA ca.crt -CAkey ca.key -in client-cert-file -out client-cert-signed -days 365 -CAcreateserial -passin pass:leonzheng
# 將CA證書導入服務器keystore
keytool -keystore server.keystore.jks -alias CARoot -import -file ca.crt -storepass leonzheng
keytool -keystore client.keystore.jks -alias CARoot -import -file ca.crt -storepass leonzheng
# 將已簽名的服務器證書導入服務器keystore
keytool -keystore server.keystore.jks -alias machine03.zheng.com -import -file cert-signed -storepass leonzheng
keytool -keystore client.keystore.jks -alias machine03.zheng.com -import -file client-cert-signed -storepass leonzheng

驗證ssl
openssl s_client -debug -connect 192.168.12.33:9093 -tls1
openssl s_client -debug -connect 192.168.12.33:9092 -tls1


config/server.properties

ssl.client.auth=required
ssl.keystore.location=/usr/local/kafka_2.11-0.10.1.0/ssl/server.keystore.jks
ssl.keystore.password=leonzheng
ssl.key.password=leonzheng
ssl.truststore.location=/usr/local/kafka_2.11-0.10.1.0/ssl/server.truststore.jks
ssl.truststore.password=leonzheng

clientssl.properties

security.protocol=SSL
ssl.truststore.location=/usr/local/kafka_2.11-0.10.1.0/ssl/client.truststore.jks
ssl.truststore.password=leonzheng
ssl.keystore.location=/usr/local/kafka_2.11-0.10.1.0/ssl/client.keystore.jks
ssl.keystore.password=leonzheng
ssl.key.password=leonzheng

bin/kafka-topics.sh --zookeeper 192.168.12.33:2181,192.168.12.33:2182,192.168.12.33:2183/kafka --create --topic testssl --partitions 3 --replication-factor 1

bin/kafka-console-producer.sh --broker-list 192.168.12.33:9093 --topic testssl --producer.config /usr/local/kafka_2.11-0.10.1.0/ssl/clientssl.properties

bin/kafka-console-consumer.sh --bootstrap-server 192.168.12.33:9093 --topic testssl --from-beginning --consumer.config /usr/local/kafka_2.11-0.10.1.0/ssl/clientssl.properties

 

 

required的適用於對客戶端安全驗證比較嚴格的場景，好比某些操做只能由特定的設備發起才能被容許訪問資源

requested適用於對客戶端安全驗證比較寬鬆的場景，客戶端能夠決定是否提供驗證信息，若是未提供或已提供未經過，仍然容許訪問資源