Generating and Replacing an SSL Certificate for Kafka

Prerequisites

• A Linux server is available. The server must install Java Development Kit 1.8.111 or later and JAVA_HOME and PATH environment variables are configured.
• Kafka SASL_SSL has been enabled for the instance.

Step 1: Generating a Certificate

1. Log in to the Linux server and run the following command to generate a keystore for the server.keystore.jks certificate:

   keytool -genkey -keystore server.keystore.jks -alias localhost -validity 3650 -keyalg RSA

   Enter the keystore password as prompted and record the password for later use.

   The password must meet the following requirements:

   • Contains 8 to 32 characters.
   • Contains at least three of the following character types: letters, digits, spaces, and special characters `-!@#$ %^&*()-_=+\|[{}]:'",<.>/? and does not start with a hyphen (-).
   • Cannot be a weak password. To check whether a password is weak, enter it in 6.

   Enter the information about the certificate owner as prompted, such as the name, company, organization, city, and country or region.

   [root@ecs-kafka ~]# keytool -genkey -keystore server.keystore.jks -alias localhost -validity 3650 -keyalg RSA
   Enter keystore password:  
   Re-enter new password: 
   What is your first and last name?
     [Unknown]:  Tom
   What is the name of your organizational unit?
     [Unknown]:  test
   What is the name of your organization?
     [Unknown]:  test01
   What is the name of your City or Locality?
     [Unknown]:  nj
   What is the name of your State or Province?
     [Unknown]:  js
   What is the two-letter country code for this unit?
     [Unknown]:  xx
   Is CN=Tom, OU=test, O=test01, L=nj, ST=js, C=xx correct?
     [no]:  y

2. Run the following command to generate a CA:

   openssl req -new -x509 -keyout ca-key -out ca-cert -days 3650

   Enter the PEM password as prompted and record the password for later use.

   The password must meet the following requirements: 4 to 1024 characters.

   Enter the information about the certificate owner as prompted, such as the country or region, city, organization, company, name, and email.

   [root@ecs-kafka ~]# openssl req -new -x509 -keyout ca-key -out ca-cert -days 3650
   Generating a RSA private key
   ............................................................................................................................................+++++
   ..........+++++
   writing new private key to 'ca-key'
   Enter PEM pass phrase:
   Verifying - Enter PEM pass phrase:
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [XX]:xx
   State or Province Name (full name) []:js
   Locality Name (eg, city) [Default City]:nj
   Organization Name (eg, company) [Default Company Ltd]:test01
   Organizational Unit Name (eg, section) []:test
   Common Name (eg, your name or your server's hostname) []:Tom 
   Email Address []:xx
   [root@ecs-kafka ~]#

3. The certificate validity can be checked only after a truststore certificate is created. Run the following command to create a server truststore certificate with the generated CA:

   keytool -keystore server.truststore.jks -alias CARoot -import -file ca-cert

   Enter the truststore password of the server certificate as prompted and record the password for later use.

   The password must meet the following requirements:

   • Contains 8 to 32 characters.
   • Contains at least three of the following character types: letters, digits, spaces, and special characters `-!@#$ %^&*()-_=+\|[{}]:'",<.>/? and does not start with a hyphen (-).
   • Cannot be a weak password. To check whether a password is weak, enter it in 6.
   Enter y when the following information is displayed:

   Trust this certificate?

4. Run the following command to create a client truststore certificate with the CA:

   keytool -keystore client.truststore.jks -alias CARoot -import -file ca-cert

   Enter the client truststore password as prompted and record the password. This password is the value of ssl.truststore.password in the configuration file used by the client to connect to the Kafka instance.

   The password must meet the following requirements:

   • Contains 8 to 32 characters.
   • Contains at least three of the following character types: letters, digits, spaces, and special characters `-!@#$ %^&*()-_=+\|[{}]:'",<.>/? and does not start with a hyphen (-).
   • Cannot be a weak password. To check whether a password is weak, enter it in 6.
   Enter y when the following information is displayed:

   Trust this certificate?

5. Sign the server certificate.
   1. Export the server certificate server.cert-file.

      keytool -keystore server.keystore.jks -alias localhost -certreq -file server.cert-file

      Enter the keystore password set in 1 as prompted.

   2. Sign the server certificate with the CA.

      openssl x509 -req -CA ca-cert -CAkey ca-key -in server.cert-file -out server.cert-signed -days 3650 -CAcreateserial

      Enter the PEM password set in 2 as prompted.

   3. Import the CA certificate to the server keystore.

      keytool -keystore server.keystore.jks -alias CARoot -import -file ca-cert

      Enter the keystore password set in 1 as prompted.

      Enter y when the following information is displayed:

      Trust this certificate?

   4. Import the signed server certificate to the server keystore.

      keytool -keystore server.keystore.jks -alias localhost -import -file server.cert-signed

      Enter the keystore password set in 1 as prompted.

6. Export the server.keystore.jks, server.truststore.jks, and server.truststore.jks certificates to the local PC.
   The server.keystore.jks and server.truststore.jks files are used to replace the keystore and truststore files in subsequent step Replacing a Certificate. client.truststore.jks is required to be stored on the client. Record the storage path and it is the value of ssl.truststore.location in the configuration file used by the client to connect to the Kafka instance.

   Figure 1 Certificate directory
   

Step 2: Replacing a Certificate

1. Log in to the console.
2. Click in the upper left corner to select a region.
   

   Select the same region as your application service.

3. Click and choose Middleware > Distributed Message Service for Kafka to open the console of DMS for Kafka.
4. Click the desired instance to view its details.
5. In the Connection area, click Re-upload next to SSL Certificate.
   Figure 2 Connection information
   

6. Set the parameters for replacing the SSL certificate by referring to Table 1.
   Figure 3 Replacing the SSL certificate
   

   Table 1 Parameters for replacing the SSL certificate

   Parameter	Description
   Key Password	Enter the keystore password set in 1.
   Keystore Password	Enter the keystore password set in 1.
   Keystore File	Import the server.keystore.jks certificate.
   Truststore Password	Enter the server truststore password set in 3.
   Truststore File	Import the server.truststore.jks certificate.

7. Click OK.
8. Click OK.
   On the Background Tasks page, if the certificate replacement task is Successful, the certificate is successfully replaced.

   

   After the original certificate is successfully replaced, you will download the certificate provided by DMS for Kafka rather than your own certificate by clicking Download on the Basic Information tab page.

Step 3: Modifying Client Configuration Files

After a certificate is replaced, modify the ssl.truststore.location and ssl.truststore.password parameters in the consumer.properties and producer.properties files on the client, respectively.

security.protocol=SASL_SSL
ssl.truststore.location=/opt/kafka_2.12-2.7.2/config/client.truststore.jks
ssl.truststore.password=dms@kafka
ssl.endpoint.identification.algorithm=

• ssl.truststore.location: path for storing the client.truststore.jks certificate.
• ssl.truststore.password: truststore password of the client certificate
• ssl.endpoint.identification.algorithm: whether to verify the certificate domain name. This parameter must be left blank, which indicates disabling domain name verification.