Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support keystore with multiple alias entries #17560

Open
wants to merge 7 commits into
base: trunk
Choose a base branch
from

Conversation

rahulnirgude
Copy link

@rahulnirgude rahulnirgude commented Oct 21, 2024

Client applications use SSL/TLS to connect with Kafka brokers in order to implement secured communication. The clients initiate SSL communication with Kafka brokers using the SSL Engine constructed from the ssl.* properties pointing to key store and trust store. This PR addresses couple of important enhancements related to how the key store is loaded for secured communication with Kafka brokers.

Problem :
Most of the times, the key store on the client side contains single key. But when the key store contains multiple keys, in order to avoid SSL handshake issues or authorization issues communicating with Kafka brokers, it is required to choose the right key from the key store.
Solution :
The key can be identified via key alias while constructing the SSL engine. This requires client to provide a new property ssl.keystore.alias that points to the key alias within the key store. The key manager implementation is modified to return the named key to be used for building the SSL Engine.

Example configuration:
ssl.keystore.alias=<alias.name>

Ashutosh Gijare and Moreshwar Dayte from Mastercard have contributed to this implementation

…to true when the keystore location string is actually a base64 encoded keystore string used in the PCF environments.
…to true when the keystore location string is actually a base64 encoded keystore string used in the PCF environments.
@github-actions github-actions bot added the small Small PRs label Oct 21, 2024
@mimaison
Copy link
Member

Thanks for the PR. This seems like a nice improvement however since it's introducing a new configuration, you need to create a KIP to propose this change. See https://cwiki.apache.org/confluence/display/KAFKA/Kafka+Improvement+Proposals

@mimaison mimaison added the kip Requires or implements a KIP label Oct 24, 2024
Copy link

This PR is being marked as stale since it has not had any activity in 90 days. If you
would like to keep this PR alive, please leave a comment asking for a review. If the PR has
merge conflicts, update it with the latest from the base branch.

If you are having difficulty finding a reviewer, please reach out on the [mailing list](https://kafka.apache.org/contact).

If this PR is no longer valid or desired, please feel free to close it. If no activity occurs in the next 30 days, it will be automatically closed.

@github-actions github-actions bot added the stale Stale PRs label Jan 23, 2025
@mimaison
Copy link
Member

@rahulnirgude Are you still interested in contributing this feature? I see you drafted a KIP (https://cwiki.apache.org/confluence/display/KAFKA/KIP-1117%3A+Support+keystore+with+multiple+alias+entries) but it's not complete and you've not started a discussion on the mailing list.

@github-actions github-actions bot removed the stale Stale PRs label Jan 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
clients kip Requires or implements a KIP small Small PRs
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants