Implementing authentication using SSL

The communication between clients and brokers is allowed over SSL using a dedicated port. This port is not enabled by default. This recipe shows how to enable encryption using SSL.

How to do it...

1. Use the Java keytool to generate an SSL key on each machine with the following command:

keytool -keystore kafka.server.keystore.jks -alias localhost -validity {validity} -genkey

For this command, validity is the valid time of the certificate in days.

2. To create your own Certificate Authority (CA), run the following command:

openssl req -new -x509 -keyout ca-key -out ca-cert -days {validity}

3. To add the generated CA to the clients' trust store, run the following command:

keytool -keystore kafka.client.truststore.jks -alias CARoot -import -file ca-cert

4. To sign the certificates in the keystore with the CA we generated, export the certificate from the keystore as follows:

keytool -keystore kafka.server.keystore.jks -alias localhost -certreq -file cert-file

5. Sign it with the...