本地主机SSL连接Docker内Confluent Kafka容器失败：证书未知错误

问题描述 #

• 明文监听器仅在KAFKA_LISTENERS设置为EXTERNAL_PLAIN://:9092时可用，设置为EXTERNAL_PLAIN://localhost:9092无效；
• 使用与容器配置相同的密钥库和密码，尝试通过SSL连接localhost:9093发送消息时，出现错误：SSL handshake failed Received fatal alert: certificate_unknown

相关配置 #

application.properties中的Spring Kafka配置 #

spring.kafka.producer.key-serializer=org.apache.kafka.common.serialization.StringSerializer
spring.kafka.producer.value-serializer=org.apache.kafka.common.serialization.StringSerializer
spring.kafka.producer.properties.max.request.size=6000000
#KAFKA GENERAL
spring.kafka.client-id=local_kafka_producer
spring.kafka.bootstrap-servers=localhost:9093
auto.create.topics.enable=true
spring.kafka.producer.group-id=producer_local
spring.kafka.security.protocol=SSL
spring.kafka.ssl.protocol=TLSv1.2
spring.kafka.producer.ssl.trust-store-location=file:C:\\docker\\truststore.jks
spring.kafka.producer.ssl.trust-store-password=password
spring.kafka.ssl.key-password=password
spring.kafka.producer.ssl.key-store-location=file:C:\\docker\\keystore.jks
spring.kafka.producer.ssl.key-store-password=password

生产者配置类 #

@Configuration
public class KafkaProducerConfig {

    @Bean
    public ProducerFactory<String, String> producerFactory(KafkaProperties kafkaProperties) {
        final Map<String, Object> props = kafkaProperties.buildProducerProperties();
        props.putAll(kafkaProperties.getProducer().buildProperties());
        return new DefaultKafkaProducerFactory<>(props);
    }

    @Bean
    public KafkaTemplate<String, String> kafkaProducerTemplate(KafkaProperties kafkaProperties) {
        return new KafkaTemplate<>(producerFactory(kafkaProperties));
    }
}

通过@Autowired注入kafkaTemplate发送消息。

Docker Compose配置文件 #

version: '3'

services:
    zookeeper:
        image: confluentinc/cp-zookeeper:latest
        container_name: zookeeper
        hostname: zookeeper
        environment:
            ZOOKEEPER_CLIENT_PORT: 2181
        volumes: 
            - zookeeperVolume:/etc/zookeeper/secrets
            - zookeeperVolume:/var/lib/zookeeper
            - zookeeperVolume:/opt/zookeeper-3.4.13
            - zookeeperVolume:/var/lib/zookeeper/data
            - zookeeperVolume:/var/lib/zookeeper/log
        ports:
            - 2181:2181
            
    kafka:
        image: confluentinc/cp-kafka
        container_name: kafka
        hostname: kafka
        environment:
            KAFKA_BROKER_ID: 1
            KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092, SSL://localhost:9093
            KAFKA_LISTENERS: PLAINTEXT://:9092, SSL://:9093 
            KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
            KAFKA_ZOOKEEPER_SASL_ENABLED: false
            KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
            KAFKA_SOCKET_REQUEST_MAX_BYTES: 1195725856
            KAFKA_HEAP_OPTS: "-Xmx12g -Xms1g"
            KAFKA_AUTO_CREATE_TOPICS_ENABLE: true
            KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: ""
            KAFKA_ZOOKEEPER_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: ""
            KAFKA_CREATE_TOPICS: ACCOUNTS-CBC-CBA-BookingHVLPReq-POC:1:1
            KAFKA_SSL_CLIENT_AUTH: 'required'
            KAFKA_SSL_ENABLED_PROTOCOLS: TLSv1.2
            KAFKA_SSL_KEYSTORE_FILENAME: keystore.jks
            KAFKA_SSL_KEYSTORE_CREDENTIALS: pass_for_truststore_keystore.txt
            KAFKA_SSL_KEY_CREDENTIALS: pass_for_truststore_keystore.txt
            KAFKA_SSL_TRUSTSTORE_FILENAME: truststore.jks
            KAFKA_SSL_TRUSTSTORE_CREDENTIALS: pass_for_truststore_keystore.txt
            
        depends_on:
        - zookeeper        
        volumes: 
            - ./kafkaSsl:/etc/kafka/secrets
            - kafkaVolume:/var/lib/kafka/data
            - kafkaVolume:/kafka
        ports:
        - 9092:9092
        - 9093:9093
          
volumes:
    kafkaVolume:
    zookeeperVolume:

请求协助排查该SSL连接失败问题。

内容的提问来源于stack exchange，提问作者Luke