Docker跨主机部署Kafka时出现SSL引擎握手失败问题的原因排查求助

DevOps 小满

2026-4-22

大家好，我现在遇到一个跨主机用Docker Compose部署Kafka的棘手问题，想请各位帮忙分析下原因。

我在两台不同主机上用同一个Docker Compose配置启动Kafka（搭配ZooKeeper），配置内容如下：

version: "2"

services:
  zookeeper:
    image: confluentinc/cp-zookeeper:5.5.7
    restart: unless-stopped
    container_name: zookeeper
    ports:
      - "2181:2181"
    environment:
      ZOOKEEPER_TICK_TIME: 2000
      ZOOKEEPER_CLIENT_PORT: 2181

  kafka:
    image: confluentinc/cp-kafka:5.5.7
    restart: unless-stopped
    container_name: kafka
    depends_on:
      - zookeeper
    ports:
      - "9092:9092"
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_LISTENERS: SSL://:9092
      KAFKA_ADVERTISED_LISTENERS: SSL://:9092
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: false
      KAFKA_DELETE_TOPIC_ENABLE: true
      KAFKA_SSL_KEYSTORE_FILENAME: broker.keystore.jks
      KAFKA_SSL_KEYSTORE_CREDENTIALS: pass
      KAFKA_SSL_KEY_CREDENTIALS: pass
      KAFKA_SSL_TRUSTSTORE_FILENAME: broker.truststore.jks
      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: pass
      KAFKA_SSL_CLIENT_AUTH: requested
      KAFKA_SECURITY_PROTOCOL: SSL
      KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: " "
      KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SSL
    volumes:
      - ./secrets:/etc/kafka/secrets

其中一台主机上启动完全正常，但另一台主机启动Kafka时抛出了致命错误：

"Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
org.apache.kafka.common.KafkaException: org.apache.kafka.common.config.ConfigException: Invalid value javax.net.ssl.SSLHandshakeException: General SSLEngine problem for configuration A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings."

我排查了两台主机的差异，发现只有证书不同：

正常启动的主机用的是SHA-512 with RSA签名算法，密钥长度2048位
报错的主机用的是SHA-384 with ECDSA签名算法，密钥长度4096位

我查了资料，Kafka应该是支持这两种证书算法的，而且我没办法更换证书，必须用现有的证书解决问题。

想请教各位，这个错误可能是什么原因导致的？有没有不用换证书的解决办法？

备注：内容来源于stack exchange，提问作者Ilya Afinogentov