Implementing authentication using SSL
The communication between clients and brokers is allowed over SSL using a dedicated port. This port is not enabled by default. This recipe shows how to enable encryption using SSL.
How to do it...
- Use the Java
keytoolto generate an SSL key on each machine with the following command:
keytool -keystore kafka.server.keystore.jks -alias localhost -validity {validity} -genkeyFor this command, validity is the valid time of the certificate in days.
- To create your own Certificate Authority (CA), run the following command:
openssl req -new -x509 -keyout ca-key -out ca-cert -days {validity}- To add the generated CA to the clients' trust store, run the following command:
keytool -keystore kafka.client.truststore.jks -alias CARoot -import -file ca-cert- To sign the certificates in the keystore with the CA we generated, export the certificate from the keystore as follows:
keytool -keystore kafka.server.keystore.jks -alias localhost -certreq -file cert-file- Sign it with the...