|
| 1 | +Configure SSL trust store |
| 2 | +^^^^^^^^^^^^^^^^^^^^^^^^^ |
| 3 | + |
| 4 | +Depending on your operating system or Linux distribution you may need to take extra |
| 5 | +steps to set up the SSL CA root certificates. If your system doesn't have the |
| 6 | +SSL CA root certificates properly set up, you may receive a ``SSL handshake failed`` |
| 7 | +error message similar to the following: |
| 8 | + |
| 9 | +.. code-block:: bash |
| 10 | +
|
| 11 | + %3|1605776788.619|FAIL|rdkafka#producer-1| [thrd:sasl_ssl://...confluent.cloud:9092/bootstr]: sasl_ssl://...confluent.cloud:9092/bootstrap: SSL handshake failed: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed: broker certificate could not be verified, verify that ssl.ca.location is correctly configured or root CA certificates are installed (brew install openssl) (after 258ms in state CONNECT) |
| 12 | +
|
| 13 | +In this case, you need to manually install a bundle of validated CA root certificates and potentially modify the client code to set the ``ssl.ca.location`` configuration property. |
| 14 | +(For more information, see the documentation for `librdkafka <https://github.com/edenhill/librdkafka/blob/master/INTRODUCTION.md#ssl>`__ on which this client is built) |
| 15 | + |
| 16 | +macOS |
| 17 | +""""" |
| 18 | + |
| 19 | +On newer versions of macOS (for example, 10.15), you may need to add an |
| 20 | +additional dependency. |
| 21 | + |
| 22 | +For the Python client: |
| 23 | + |
| 24 | +.. code-block:: bash |
| 25 | +
|
| 26 | + pip install certifi |
| 27 | +
|
| 28 | +For other clients: |
| 29 | + |
| 30 | +.. code-block:: bash |
| 31 | +
|
| 32 | + brew install openssl |
| 33 | +
|
| 34 | +Once you install the CA root certificates, set the ``ssl.ca.location`` property in the client code. |
| 35 | +Edit both the producer and consumer code files, and add the ``ssl.ca.location`` configuration parameter into the producer and consumer properties. |
| 36 | +The value should correspond to the location of the appropriate CA root certificates file on your host. |
| 37 | + |
| 38 | +For the Python client, use ``certifi.where()`` to determine the location of the certificate files: |
| 39 | + |
| 40 | +.. code-block:: text |
| 41 | +
|
| 42 | + ssl.ca.location: certifi.where() |
| 43 | +
|
| 44 | +For other clients, check the install path and provide it in the code: |
| 45 | + |
| 46 | +.. code-block:: text |
| 47 | +
|
| 48 | + ssl.ca.location: '/usr/local/etc/openssl@1.1/cert.pem' |
| 49 | +
|
| 50 | +
|
| 51 | +CentOS |
| 52 | +"""""" |
| 53 | + |
| 54 | +You may need to install CA root certificates in the following way: |
| 55 | + |
| 56 | +.. code-block:: bash |
| 57 | +
|
| 58 | + sudo yum reinstall ca-certificates |
| 59 | +
|
| 60 | +This should be sufficient for the Kafka clients to find the certificates. |
| 61 | +However, if you still get the same error, you can set the ``ssl.ca.location`` property in the client code. |
| 62 | +Edit both the producer and consumer code files, and add the ``ssl.ca.location`` configuration parameter into the producer and consumer properties. |
| 63 | +The value should correspond to the location of the appropriate CA root certificates file on your host, for example: |
| 64 | + |
| 65 | +.. code-block:: text |
| 66 | +
|
| 67 | + ssl.ca.location: '/etc/ssl/certs/ca-bundle.crt' |
0 commit comments