使用Bitnami镜像配置SSL Kafka时遇认证方案错误求助

问题重现 #

配置Bitnami Kafka镜像启用SSL时，出现错误：

No available authentication scheme for configuration A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings.

原docker-compose.yml配置：

services:
  zookeeper:
    image: bitnami/zookeeper:latest
    ports:
      - "2181:2181"
    environment:
      - ALLOW_ANONYMOUS_LOGIN=yes
  kafka:
    image: bitnami/kafka:latest
    ports:
      - "9093:9093"
    environment:
      KAFKA_CFG_LISTENERS: SSL://:9093
      ALLOW_PLAINTEXT_LISTENER: yes 
      KAFKA_CFG_ADVERTISED_LISTENERS: SSL://kafka:9093
      KAFKA_CFG_ZOOKEEPER_CONNECT: 'zookeeper:2181'
      KAFKA_CFG_INTER_BROKER_LISTENER_NAME: SSL
      KAFKA_ZOOKEEPER_PROTOCOL: PLAINTEXT
      KAFKA_CFG_SSL_KEYSTORE_LOCATION: /bitnami/kafka/config/certs/kafka.keystore.jks
      KAFKA_CFG_SSL_KEYSTORE_PASSWORD: kafkakeystorepass
      KAFKA_CFG_SSL_TRUSTSTORE_LOCATION: /bitnami/kafka/config/certs/kafka.truststore.jks
      KAFKA_CFG_SSL_TRUSTSTORE_PASSWORD: kafkatruststorepass
    volumes:
      - "./secrets/kafka.broker.keystore.jks:/bitnami/kafka/config/certs/kafka.keystore.jks"
      - "./secrets/kafka.broker.truststore.jks:/bitnami/kafka/config/certs/kafka.truststore.jks"

错误原因 #

核心是SSL认证配置不完整，导致broker与客户端（含broker自身跨节点通信）的SSL握手时，没有共同支持的认证方案。具体缺失关键SSL参数，且未明确证书类型与认证规则。

修复步骤 #

1. 补充缺失的SSL核心配置项 #

在Kafka服务的environment中添加以下参数：

• KAFKA_CFG_SSL_KEY_PASSWORD：与keystore中密钥的密码一致（即使和keystore密码相同也需显式配置）
• KAFKA_CFG_SSL_CLIENT_AUTH：设置为required（强制客户端认证）或requested（可选），必须指定该参数
• KAFKA_CFG_SSL_ENABLED_PROTOCOLS：指定兼容的TLS版本，如TLSv1.2,TLSv1.3
• KAFKA_CFG_SSL_KEYSTORE_TYPE：JKS（因使用JKS格式证书文件）
• KAFKA_CFG_SSL_TRUSTSTORE_TYPE：JKS

同时移除无用的ALLOW_PLAINTEXT_LISTENER: yes，当前仅配置了SSL监听器，该参数无意义。

2. 验证证书有效性 #

• 确认keystore中的证书CN或SAN字段包含kafka主机名（与advertised listeners中的地址一致）
• 确认truststore中已导入自签名CA证书或broker证书，确保客户端能信任broker
• 使用keytool验证证书文件与密码匹配：

keytool -list -v -keystore ./secrets/kafka.broker.keystore.jks
keytool -list -v -keystore ./secrets/kafka.broker.truststore.jks

3. 修改后的完整docker-compose.yml #

services:
  zookeeper:
    image: bitnami/zookeeper:latest
    ports:
      - "2181:2181"
    environment:
      - ALLOW_ANONYMOUS_LOGIN=yes
  kafka:
    image: bitnami/kafka:latest
    ports:
      - "9093:9093"
    environment:
      KAFKA_CFG_LISTENERS: SSL://:9093
      KAFKA_CFG_ADVERTISED_LISTENERS: SSL://kafka:9093
      KAFKA_CFG_ZOOKEEPER_CONNECT: 'zookeeper:2181'
      KAFKA_CFG_INTER_BROKER_LISTENER_NAME: SSL
      KAFKA_ZOOKEEPER_PROTOCOL: PLAINTEXT
      # 核心SSL配置补充
      KAFKA_CFG_SSL_KEYSTORE_LOCATION: /bitnami/kafka/config/certs/kafka.keystore.jks
      KAFKA_CFG_SSL_KEYSTORE_PASSWORD: kafkakeystorepass
      KAFKA_CFG_SSL_KEYSTORE_TYPE: JKS
      KAFKA_CFG_SSL_KEY_PASSWORD: kafkakeystorepass # 需与密钥密码一致
      KAFKA_CFG_SSL_TRUSTSTORE_LOCATION: /bitnami/kafka/config/certs/kafka.truststore.jks
      KAFKA_CFG_SSL_TRUSTSTORE_PASSWORD: kafkatruststorepass
      KAFKA_CFG_SSL_TRUSTSTORE_TYPE: JKS
      KAFKA_CFG_SSL_CLIENT_AUTH: required
      KAFKA_CFG_SSL_ENABLED_PROTOCOLS: TLSv1.2,TLSv1.3
    volumes:
      - "./secrets/kafka.broker.keystore.jks:/bitnami/kafka/config/certs/kafka.keystore.jks"
      - "./secrets/kafka.broker.truststore.jks:/bitnami/kafka/config/certs/kafka.truststore.jks"

内容的提问来源于stack exchange，提问作者Divyanshu Sen