1

Tried to configure Schema registry with SSL. When attempted to use HTTPS schema registry with AVRO Producer, it failed with error 

No SAN Name found

I had configured to ignore the host name checking. but still didnt work. Similar configuration had worked on KAFKA REST, CONNECT and KSQL.

ALso tried to run query from KSQL which uses schema registry. Failed with same error that No SAN Name found.

Below were configuration on Schema Registry for HTTPS;

listeners=https://0.0.0.0:8081
ssl.keystore.location=/confluent-5.5.0/cert/kafka.server.keystore.jks
ssl.keystore.password=password
ssl.key.password=password

On avro producer and KSQL i had configured truststore and specified 

ssl.endpoint.identification.algorithm=

Can you please help configure Schema registry with HTTPS and have it work with avro producer and KSQL?

Giorgos Myrianthous
  • 36,235
  • 20
  • 134
  • 156
WebDeveloper2017
  • 73
  • 1
  • 9

1 Answers1

0

It seems that Subject Alternative Name (SAN) is missing from your certificates.

To do so, append the argument -ext SAN=DNS:{FQDN} to the keytool command:

keytool \
    -keystore kafka.server.keystore.jks \
    -alias localhost \
    -validity {validity} \
    -genkey \
    -keyalg RSA \
    -ext SAN=DNS:{FQDN}

Make sure to inclued SAN when creating servers' keystores. This is also mentioned in the Confluent's Security Tutorial:

If host name verification is enabled, clients will verify the server’s fully qualified domain name (FQDN) against one of the following two fields:

  1. Common Name (CN)
  2. Subject Alternative Name (SAN)

Both fields are valid, however RFC-2818 recommends the use of SAN. SAN is also more flexible, allowing for multiple DNS entries to be declared. Another advantage is that the CN can be set to a more meaningful value for authorization purposes.

Alternatively, you can choose to disable server host verification:

Disable server host name verification by setting ssl.endpoint.identification.algorithm to an empty string.

Therefore, you just need to set in server.properties the following configuration and finally restart your Kafka Cluster:

ssl.endpoint.identification.algorithm=
Community
  • 1
  • 1
Giorgos Myrianthous
  • 36,235
  • 20
  • 134
  • 156
  • Thank you for the update. But I have already added ssl.endpoint.identification.algorithm= . The same worked in KSQL, Connector. But not on Schema Registry. – WebDeveloper2017 May 13 '20 at 15:51
  • @WebDeveloper2017 Have you restarted Kafka cluster after changing the config? – Giorgos Myrianthous May 13 '20 at 15:52
  • Yes I have restarted the cluster as well as schema Registry. Here my understanding is that issue is on schema registry. When I start console producer or try query in KSQL that is when I am getting error in the schema Registry – WebDeveloper2017 May 13 '20 at 23:23