Spring-Kafka客户端TLS连接Kafka集群证书验证失败求助

非TLS方式下Kafka生产/消费均正常，但启用TLS后，基于Spring-Kafka（org.springframework.kafka.core.DefaultKafkaConsumerFactory）的Java消费者出现经典的PKIX路径构建失败错误，具体报错如下：

2024-03-26 18:34:12.292 [kafkaMessageListenerContainer-C-1] ERROR o.s.k.l.KafkaMessageListenerContainer - Authentication/Authorization Exception and no authExceptionRetryInterval set
org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
    ...
    at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
    ...
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
    at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
    at java.base/sun.security.validator.Validator.validate(Validator.java:264)
    ...
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146)
    at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:127)
    at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
    ... 36 common frames omitted

绕过应用直接用OpenSSL验证信任库，结果成功，说明信任库本身有效：

$ openssl s_client -verify 100 -showcerts -connect server1.fqdn:9093 -CAfile <(keytool -list -rfc -keystore /some/path/to/my/truststore.p12 -storepass somepwd)

SSL handshake has read 2440 bytes and written 138 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 3072 bit
Secure Renegotiation IS supported
...
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
...
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

信任库仅包含签署服务器证书的根CA证书，服务器密钥库仅包含自身证书（CN为server1.fqdn），本次为双向TLS连接。通过javax.net.debug=all查看服务器证书内容，推测问题与首次协商或信任库的使用方式有关。

已尝试以下操作但未解决问题：

• 通过javax.net.ssl.trustStore系统属性指定信任库，仍报错
• 将服务器证书加入信任库，OpenSSL验证正常但应用依旧失败
• 修改ssl.truststore.password触发合法错误，确认信任库已被应用加载

环境与配置信息 #

Kafka环境 #

• Kafka版本：3.6.0
• Controller模式：Kraft

消费者配置 #

bootstrap.servers=server1.fqdn:9093,server2.fqdn:9093,server3.fqdn:9093
group.id=stg                     
ssl.cipher.suites = null
ssl.enabled.protocols = [TLSv1.2, TLSv1.3]
ssl.endpoint.identification.algorithm = https
ssl.engine.factory.class = null
ssl.key.password = [hidden]
ssl.keymanager.algorithm = SunX509
ssl.keystore.certificate.chain = null
ssl.keystore.key = null
ssl.keystore.location = /some/path/to/my/keystore.p12
ssl.keystore.password = [hidden]
ssl.keystore.type = JKS
ssl.protocol = TLSv1.3
ssl.provider = null
ssl.secure.random.implementation = null
ssl.trustmanager.algorithm = PKIX
ssl.truststore.certificates = null
ssl.truststore.location = /some/path/to/my/truststore.p12
ssl.truststore.password = [hidden]
ssl.truststore.type = JKS
security.protocol = SSL
security.providers = null
sasl.mechanism = GSSAPI

内容的提问来源于stack exchange，提问作者Marvin