使用kaf CLI连接SASL SSL Kafka Broker遇x509证书匹配错误求助

环境配置 #

部署背景 #

基于Kafka生产者消费者教程的docker-compose-ssl.yml配置部署SSL加密的Kafka集群。

SERVER_JAAS.conf认证配置 #

KafkaServer {
   org.apache.kafka.common.security.plain.PlainLoginModule required
   username="kafkabroker"
   password="kafkabroker-secret"
   user_kafkabroker="kafkabroker-secret"
   user_client="client-secret";
};

Client {
   org.apache.zookeeper.server.auth.DigestLoginModule required
   username="kafka"
   password="kafka-secret";
};

Docker容器运行状态 #

NAME                IMAGE                             COMMAND                  SERVICE             CREATED             STATUS              PORTS
kafka1-ssl          confluentinc/cp-kafka:6.1.1       "/etc/confluent/dock…"   kafka1-ssl          38 minutes ago      Up 35 minutes       0.0.0.0:9093-9094->9093-9094/tcp, 9092/tcp, 0.0.0.0:29093-29094->29093-29094/tcp
zookeeper-ssl       confluentinc/cp-zookeeper:6.1.1   "/etc/confluent/dock…"   zookeeper1          39 minutes ago      Up 35 minutes       2888/tcp, 0.0.0.0:2181->2181/tcp, 3888/tcp

kaf CLI配置 #

- name: ssl_local
  version: ""
  brokers:
  - localhost:29094
  SASL:
    mechanism: SCRAM-SHA-512
    username: "kafkabroker"
    password: "kafkabroker-secret"
    clientID: ""
    clientSecret: ""
    tokenURL: ""
    token: ""
  TLS: null
  security-protocol: SASL_SSL
  schema-registry-url: ""

错误信息 #

执行kaf topic ls命令时触发证书验证失败：

>> kaf topic ls
Unable to get cluster admin: kafka: client has run out of available brokers to talk to: x509: certificate is not valid for any names, but wanted to match localhost 

解决方案 #

原因分析 #

Kafka Broker生成的SSL证书未包含localhost作为有效域名（Subject Alternative Name/Common Name字段缺失），导致客户端以localhost连接时证书验证不通过。

具体解决步骤 #

1. 测试环境临时绕过证书验证（仅用于调试，禁止生产环境）

修改kaf CLI配置，开启TLS不安全跳过验证：

- name: ssl_local
  version: ""
  brokers:
  - localhost:29094
  SASL:
    mechanism: SCRAM-SHA-512
    username: "kafkabroker"
    password: "kafkabroker-secret"
    clientID: ""
    clientSecret: ""
    tokenURL: ""
    token: ""
  TLS:
    insecure-skip-tls-verify: true
  security-protocol: SASL_SSL
  schema-registry-url: ""

2. 重新生成包含localhost的证书（生产环境推荐）

• 找到证书生成脚本对应的openssl.cnf配置文件，在[alt_names]段添加localhost的域名和IP：

  DNS.1 = kafka1-ssl
  DNS.2 = localhost
  IP.1 = 127.0.0.1
  

• 重新生成SSL证书和密钥文件，替换docker-compose挂载目录中的旧证书
• 重启Kafka容器

3. 使用容器服务名连接客户端

• 在本地/etc/hosts添加主机映射：

  127.0.0.1 kafka1-ssl
  

• 修改kaf CLI的broker地址为容器服务名：

  brokers:
  - kafka1-ssl:29094
  

内容的提问来源于stack exchange，提问作者curiousguy