Help Center/ MapReduce Service/ Developer Guide (LTS)/ Kafka Development Guide (Security Mode)/ FAQs in Kafka Application Development/ SSL Encryption Function Used by a Kafka Client
Updated on 2026-06-29 GMT+08:00
View PDF
Share

SSL Encryption Function Used by a Kafka Client

Prerequisites

Description

  • SSL used by a Linux client
    1. Change the value of security.protocol in the client installation directory/Kafka/kafka/config/producer.properties and client installation directory/Kafka/kafka/config/consumer.properties directories to SASL_SSL or SSL.

      If the Spring-Kafka module is used to access the Kafka sample, change the value of security.protocol in springboot/kafka-examples/module-spring-kafka-example/src/main/resources/application.properties in the sample code to SASL_SSL or SSL.

    2. When using the Shell commands, enter a port ID corresponding to the protocol set in Step 1. For example, if security.protocol is set to SASL_SSL, an SASL_SSL protocol port ID is required, which is 21009 by default:

      bin/kafka-console-producer.sh --broker-list <IP address of a Kafka cluster:21009> --topic <Topic name> --producer.config config/producer.properties

      bin/kafka-console-consumer.sh --topic <Topic name> --bootstrap-server <IP address of a Kafka cluster:21009> --consumer.config config/consumer.properties

  • SSL used by a Windows client
    1. Download the Kafka client, decompress the client, and find the ca.crt file in the root directory.
    2. Use the ca.crt file to generate the TrustStore file of the client.

      Run the following command in the Java running environment:

      keytool -noprompt -import -alias myservercert -file ca.crt -keystore truststore.jks

    3. Copy the generated truststore.jks file to the conf directory of the IntelliJ IDEA project and add the following codes to the client codes:

      Add the following code to the client code (construction method of Producer.java or Consumer.java) in versions earlier than MRS 3.6.0:

      //truststore file address 
props.put("ssl.truststore.location", System.getProperty("user.dir") + File.separator + "conf" + File.separator + "truststore.jks");
//truststore file password (password when the TrustStore file is generated) 
props.put("ssl.truststore.password", "XXXXX");

      In MRS 3.6.0 and later versions, add the following code to the client code (the init() method of Producer.java and Consumer.java or the initPropertiesByResources(Map<String,Object> properties) method of KafkaProperties.java): Add the header file import java.io.File; to the current .java file.

      //truststore file address 
properties.put("ssl.truststore.location", System.getProperty("user.dir") + File.separator + "conf" + File.separator + "truststore.jks");
//truststore file password (password when the TrustStore file is generated) 
properties.put("ssl.truststore.password", "XXXXX");
    4. Change the values of security.protocol in producer.properties and consumer.properties in the src/main/resources directory of the client sample project as required, and change the value of bootstrap.servers in the producer.properties file to ensure that the type of security.protocol matches with the port ID of bootstrap.servers.

      If the Spring-Kafka module is used to access the Kafka sample, change the value of security.protocol in the application.properties file in the src/main/resources directory. Change the value of bootstrap.servers in the application.properties file to ensure that the security.protocol protocol type matches the port number in bootstrap.servers.