Kafka ssl handshake. We're using mTLS authentication with the setup of Root CA and Intermediate CA with Vault. 2. Selector) It works when I set the Kafka's server properties like and I made the key with "CN:localhost" but the logstash and kafka is not on the same machine. On 2. First of all, I create the keystore and trustore by following command : keytool -keystore server. 4 tasks. Kafka Connect itself seems to complete SSL handshake, but the sql-server-source-connect. 27. x client with Heroku Kafka? Issue. Make sure that the client and broker are using the same SSL protocol. To isolate the issue I made sure no apps are running and trying to connect to the Kafka cluster. Handshake failures could also indicate misconfigured security including protocol/cipher suite mismatch, server certificate authentication failure or server host name verification failure. enabled. cd ssl. Import the CA certificate to the truststore. a. this is where it breaks. 0 upgrade notes, the broker setting ssl. Oct 28, 2021 · You signed in with another tab or window. To troubleshoot this issue, check the network connectivity by performing the following connectivity test. Hope this helps! Share SSL handshake failures in clients may indicate client authentication failure due to untrusted certificates if server is configured to request client certificates. Hi Team, I am running Kafka cluster with ingress external listener. batch. key-store-type=PKCS12. 7. jks Sep 11, 2018 · I am using KafkaPublish processor to publish messages to a kafka topic secured using SASL_SSL security protocol (we are not using Kerberos). What was tried: It was suggested to set one of the broker configs, ssl. You switched accounts on another tab or window. over 2 years ago. p12 -nocerts -nodes -out key Sep 16, 2016 · 2016-09-15 21:43:02 DEBUG SaslClientAuthenticator:204 - Set SASL client state to RECEIVE_HANDSHAKE_RESPONSE 2016-09-15 21:43:02 DEBUG NetworkClient:476 - Completed connection to node 0 2016-09-15 21:43:02 DEBUG Acceptor:52 - Accepted connection from /127. 9094 is external TLS listener. put("ssl. My requirement is broker should authenticate only specific clients. prop. Kafka Connect failing to read from Kafka topics over SSL. But when I am trying to test the Jan 26, 2018 · Kafka SSL handshake failed issue. password = confluent ssl. 1 and configuring an SSL connection between kafka client (consumer) written in java and a kafka cluster (3 nodes with each node having one broker). sslauthenticationexception: ssl handshake failed error, Kafka will not be able to establish a secure connection with other Kafka nodes or clients. The generated CA is a public-private key pair and certificate used to sign other certificates. properties of the broker. 0_275. acks = 1. p12, ca-cert, kafka. kafka: 2. put("security. But now that I'm using staging certs, I get this when I run the producer: Jan 24, 2022 · kafka queue ssl handshake. protocol=SSL kafka. Aug 14, 2019 · Please note that I had followed the steps mentioned in the above link to set up SSL encryption and authentication for Kafka and Schema registry. Feb 17, 2023 · Kafka Producer in . iosb-ina-mr opened this issue on Feb 10, 2023 · 4 comments. os: ubuntu 18. SSL handshake failed: error:0A000086:SSL routines::certificate verify failed: broker certificate could not be verified, verify that ssl. To use the protocol, you must specify one of the four authentication methods supported by Apache Kafka: GSSAPI, Plain, SCRAM-SHA-256/512, or OAUTHBEARER. 41 is broker21 and 10. Allow unsafe renegotiation: false. python confluent kafka: Group authorization failed. You signed out in another tab or window. pem) # keytool -exportcert -alias kafkaclient -keystore kafka. 12. the Kafka adapter). 2080. Oct 2, 2018 · Without more details it's hard to tell for sure, but 2. put("sasl. pem Value of ssl. key files (it's in directory inside container). algorithm="" instead of ssl. openssl req -new -x509 -keyout ca-key -out ca-cert Nov 17, 2022 · Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. Hello we are facing this issue in using the plugin "kafka-tools 1. 1 (SSL handshake failed) (org. 1 (SSL handshake failed) 16:59:31. Verify that the keystore and truststore files have the correct passwords and aliases. todo. #1521. Feb 10, 2023 · SSL handshake failed #1521. Line 65 of the script looks at the KAFKA_ADVERTIZED_LISTENERS environment variable to determine whether or not SSL is configured. Copy link laurafbec commented Jan 10, 2022. Net - SSL Handshake Failed. Make sure that the client and broker are using valid and up-to-date SSL certificates. Spark "Failed to construct kafka consumer" via SSL. location(key. Self-Managed Connectors. I have a keystore and certificate (. algorithm is now set to https. Apr 28, 2023 · All the errors suggest that something is trying to connect to all the Kafka broker ports without properly configured TLS. (kafka. Is secure renegotiation: false. 1 Kafka + SSL: General SSLEngine problem for configuration A client . jks -srcalias kafkaclient -destkeystore cert_and_key. To fix your issue, replace: adminConfig. config configuration property ( recommended) Pass a static JAAS configuration file into the JVM using the java. Hello, how are you ? when running compose, it returns this error, any tips? org. So you have two options: Remove the authentication from the Kafka CR. I have to add encryption and authentication with SSL in kafka. NetworkClient - [Producer clientId=producer-1] Connection Q: What are the consequences of not fixing the org. Selector) I use SASL_SSL protocol with PLAIN mechanism to communicate with Kafka. Debezium-connector-mysql failed. broker. Plaintext listener only works when KAFKA_LISTENERS for EXTERNAL_PLAIN is set to EXTERNAL_PLAIN://:9092 ( Jan 6, 2023 · Filebeat Kafka client failing SSL handshake with AWS MSK. Jun 25, 2019 · 1. May 25, 2022 · Kafka client cannot connect to server via SSL connection for some reason. pem) # keytool -v -importkeystore -srckeystore kafka. key. Some possible reasons for SSL handshake failures are: 1. The IPs that are having SSL issue connecting to Kafka are from kube-system namespace pods (internal pods to implement cluster features). Jun 3, 2020 · Value of ssl. I have a kafka cluster on docker using confluent images. SSl params being used are below. Here, the Kafka broker (i. A keystore contains private keys and the associated certificates for their corresponding public keys. 0 to CP5. Thanks. Jun 26, 2020 · INFO [SocketServer brokerId=0] Failed authentication with /kafka client's ip (SSL handshake failed) (org. Dec 20, 2020 · まずzookeeperを起動し、kafkaを起動する前に、kafka-configsコマンドでkafkaadminユーザーを登録します。. Copy the CA certificate to client machine from the CA machine (wn0). Viewed 2k times 2 This is the first time I am trying to Apr 7, 2022 · Check for a correct IP address and port combination passed in command bin/kafka-consumer-groups. cer) files as well, which i got it from the other downstream Team. Nov 3, 2023 · Issue 1: We are trying to connect from a DOTNET client (3. protocol=SASL_PLAINTEXT. This is only used for when the client needs to auth towards the broker. Apache kafka 允许clinet通过SSL连接，SSL默认是不可用的，需手动开启。 主要步骤是： 生成SSL密钥和证书; 配置kafka broker; 配置kafka 客户端; 1. We'll also open the connection with brokers 2 and 3 just to make sure that. 1) to Kafka. 17. Meaning your clientAuth certificate presented by your Kafka Consumer must have its complete trust chain in the Kafka servers truststore. sh --bootstrap-server 192. jks -deststoretype pkcs12. Run the command from the client machine. sh --list --bootstrap-server 172. One of the main reasons you might choose SASL-SSL over SSL is Mar 28, 2020 · I'm running kafka 2. In the end I resolved the issue by providing zookeeper chroot path (/kafkaTest) when creating principals: I am having SSL handshake failures with Windows Certificate Store when there is a Intermediate CA. Jan 11, 2021 · kafka使用ssl加密和认证. It goes through SSL handshake, I can see it in the client trace log, but then occasionally fails with "disconnected" message. 629 [kafka-producer-network-thread | producer-1] INFO o. Allow legacy hello messages: true. Use the Java keytool to generate a keystore for each Kafka broker: Aug 31, 2020 · I setup the SSL for kafka. java: 1. This, by default, requires one-way authentication using public key encryption where the client authenticates the server certificate. laurafbec opened this issue Jan 10, 2022 · 4 comments Comments. properties content: security. Sign in to the client machine (hn1) and navigate to the ~/ssl folder. Confluent kafka downloaded from Nuget package. location=dir/xxxxx. sslauthenticationexception: ssl handshake failed error? A: If you do not fix the org. The intermediate CA is available in AWS PCA which is assigned to AWS MSK cluster which in turn Kafka SSL handshake failed issue. This value was changed in 2. endpoint. See the Admin client configuration section on the Apache Kafka website for the list of settings. I have keystore and certificate on Kafka broker and ca-cert on the client. kafka. inter. The first step in configuring SSL/TLS for Kafka is to create keystores for each of your Kafka brokers. 0 with SASL-SCRAM - SSL peer is not authenticated, returning ANONYMOUS instead Feb 2, 2022 · My app is a client for kafka. 168. 2:9093 Confluent Platform supports Transport Layer Security (TLS) encryption based on OpenSSL, an open source cryptography toolkit that provides an implementation of the Transport Layer Security (TLS) and Secure Socket Layer (SSL) protocols With TLS authentication, the server authenticates the client (also called mutual authentication (mTLS)). Sep 25, 2023 · I have problem with connecting from local host machine to kafka broker in container. Oct 28, 2021 · Modified 2 years, 4 months ago. To explain my configuration: I have 3 listeners setup - one on a public interface, and two on private interfaces (one for inter-broker comms and one for internal consumers) SSL is enabled on all 3 listeners. We are trying to send logs using Filebeat to AWS MSK (Provisioned) using kafka configuration available. Authentication with SASL SCRAM wasn't working on 2. 1 IOException during embedded broker startup 5 Kafka Listener method could not be invoked with the incoming message Aug 1, 2020 · I have Kafka running on openshift and have exposed a route (TLS passthrough) to access the Kafka broker. common. 1 it was OK. The kafka topic is SSL secured. kafka. location = /etc/kafka/secrets/kafka. I have a running Kafka Connect instance and have submitted my connector with the following configuration at the bottom of this post. Aug 22, 2019 · one way to find out is to use $ export KAFKA_OPTS="-Djavax. config property at runtime. protocol=SSL. p12 -deststoretype PKCS12 # openssl pkcs12 -in cert_and_key. the server) is presenting its public certificate to the client (i. 0. sasl. kafka failed authentication due to: SSL handshake failed. Kafka? It solved some SLL errors. SslAuthenticationException: SSL handshake failed Caused by: javax. debug=ssl:handshake:verbose" before running your producer. Viewed 12k times. net. Your configuration uses security. ca. 27 kafka failed authentication due to: SSL handshake failed. cluster. jks -rfc -file certificate. I am using docker-compose to build the containers. May 16, 2019 · Caused by: javax. location = /etc/kafka Feb 27, 2019 · kafka failed authentication due to: SSL handshake failed. Once enabled you can find the ClientHello and ServerHello sections to compare cipher suites: *** ClientHello Apr 18, 2018 · You use SSL for inter-broker communication. 2), we started seeing our clients failing with. cert. 7. I want to connect with remote server where kafka is deployed using SSL certificate. kafka-clients:2. ssl. 0. Check the SSL protocols. 0, (2) Firewall blocking Kafka TLS traffic (eg it may only allow HTTPS traffic), (3) Transient network issue. Ask Question Asked 1 year, 1 month ago. Dec 22, 2021 · [2021-12-22 14:23:38,084] INFO [SocketServer brokerId=1] Failed authentication with /<node_ip> (SSL handshake failed) (org. keytool -importkeystore -srckeystore server. So kafka as server declines the connection because the CURL client certificate is not valid Aug 10, 2023 · What do you see instead? Team, I am doing a POC for our setup on Kafka 3. 40 is broker11) IPs are dummy ones Jul 24, 2022 · 使用 sasl/scram-sha-256 进行身份验证. My organization has a CA which issue all certificates in pkcs12 format. 为简单起见，我们将只设置一个代理和客户端，但我们还将在此过程中记录您需要为更复杂的配置做什么。 Oct 18, 2021 · When devices on a network — say, a browser and a web server — share encryption algorithms, keys, and other details about their connection before finally agreeing to exchange data, it’s called an SSL handshake. redist 0. GroupId = groupID, vinhali commented on May 23, 2021. auth. connect. Note that our Introduction to SSL using JSSE covers the basics of SSL in more detail. It seems to try all of them -> even the 9090 and 9091 which should normally be protected by the network policies. clients. 2 to default to https so setting it to nothing worked. pem, kafka. First of all, we can configure SSL for encryption between the broker and the client. Im doing upgrade from CP5. SASL_SSL: I can consume directly to broker to broker with port 9094 (Using only dns broker due it needs to validate the certificate) SASL_SSL: I cannot consume directly to DNS principal configured with Round Robin with port 9094; The issue is: * (x)SASL_SSL: I cannot consume directly to DNS principal configured with Round Robin with port 9094 For Confluent Control Center stream monitoring to work with Kafka Connect, you must configure SASL/PLAIN for the Confluent Monitoring Interceptors in Kafka Connect. jks -alias localhost -validity 1000 -genkey. location",${unix or Windows path}); Apr 25, 2018 · It works fine with PLAINTEXT connection, but doesn't work with SSL connection. SSLProtocolException: Handshake message sequence violation, 2. mechanism. But the client configures only the truststore. When the brokers connect and talk to each other they act as clients. errors. Feb 20, 2024 · If you don't need authentication, the summary of the steps to set up only TLS encryption are: Sign in to the CA (active head node). mechanisms=PLAIN. It fails only when I try it from the OpenShift environment. My spring boot have access to keystore. $ keytool -keystore kafka. Hi everyone, Apr 8, 2021 · Thank you Jakub for your response. Jun 4, 2021 · I am trying to setup 2 way ssl authentication. 1 where I use GSSAPI as security. check handshake state: server_hello[2] Jun 28, 2022 · Try to remove the key-store type parameter and alter your parameters something similar to. kafka - ssl handshake failing. kafka broker POD stdout logs are filled with following messages. protocol = SSL ssl. – mazaneicha. # Create a java keystore and get a signed certificate for the broker. Below are server. 1. And this app running in container inside kubernetes. size = 16384. truststore. auth ), I found a very helpful snippet here. X. Dec 20, 2021 · Hi i have an issue on start this command for list topics. Net using Confluent Kafka. properties, depending on whether the connectors are sources or sinks. 1. e. protocol=PLAIN. 1" For what is worth, for those coming here having trouble when connecting clients to Kafka on SSL authentication required ( ssl. zookeeper and kafka seems ok /opt/kafka/bin/kafka-topics. config. clients Apr 27, 2023 · I tried disable SSL check by this parameters: KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: "" KAFKA_PRODUCER_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: "" KAFKA_CONSUMER_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: "" It leaves me with the situation when messages aren't acknowledged and broker isn't reachable. While doing upgrade I noticed this INFO message which repeats itself every 10seconds (10. properties correctly . x Kafka versions. SSLHandshakeException: No name matching kafka-ssl found There are two ways to configure Kafka clients to provide the necessary information for JAAS: Specify the JAAS configuration using the sasl. I am learning Apache Kafka and I do not understand how to make kafka-topics. 使用 sasl/scram-sha-512 进行身份验证. Paolo Scolamacchia Certified Senior Developer. Apr 4, 2023 · I am trying to get Kafka to use SSL but I am getting the following error: kafka-producer-network-thread | console-producer, WRITE: TLSv1. I have verified that key and certificate are valid for kafka broker by successfully running a console consumer: But I cannot send message using Spring Boot (2. Check the SSL certificates. Kafka and Zookeeper services start successfully with the latest revision. Create a KafkaUser resource with TLS authentication, get the certificate it generates and use it in your client. protocol = SSL producer. 4. As mentioned in the 2. svc. local found. client. I confirm no consumer with invalid cert is communicating with this cluster. 官方的步骤 Dec 28, 2023 · To handle SSL handshake failures in Apache Kafka, you can follow the following steps: Check the Kafka broker logs for SSL handshake failure messages. Kafka + SSL: General SSLEngine problem for configuration A client Sep 15, 2023 · Kafka Cluster showing continuous logs "INFO [SocketServer] Failed authentication (SSL handshake failed) (org. This process applies in both directions in the mutual TSL handshake. protocol", "SSL"); prop. Aug 1, 2021 · @austindev4 I don't really get this part:. steps i fo Jul 27, 2022 · Spring Kafka (2. See Article How to enable SSL debug logging in Mulesoft Products for instructions. login. Sep 14, 2021 · Using SSLEngineImpl. Dec 8, 2020 · 16:59:31. security. location is correctly configured or root CA certificates are installed (install ca-certificates Jul 9, 2018 · I observed the same duration when running Java clients (kafka-console-consumer and kafka-console-producer) UPDATE: As recommended by @edenhill When I setup the broker on an Ubuntu virtual machine and connected the clients from Windows, the latency is no longer observed. jks ssl. SSLHandshakeException: No available authentication scheme for configuration A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings. Inspect these details, and consider them when inspecting any SSL-related errors that may come shortly after this log entry. After creating, on my machine, I run the kafka-provided kafka-console-consumer. May 17, 2019 · I had incorrectly set the value of ssl. 1 with plaintext and TLS enabled. x Java client in a producer or consumer, when attempting to produce or consumer messages you receive an SSL handshake failure, such as the following: SSL handshake failures in clients may indicate client authentication failure due to untrusted certificates if server is configured to request client certificates. everything is running as expected: May 6, 2022 · Once the TLS handshake is complete, Kafka will then consult its ACL configuration to see if the authenticated user (principal) is allowed to perform the requested action on that resource Jul 18, 2022 · Having all the intermediate CA (s) and the root CA, means you have the complete trust chain in your truststore. While doing so, we are running into the below issue: SSL handshake unsuccessful. security. In configuration I use. listeners=PLAINTEXT:// 192. SASL-SSL (Simple Authentication and Security Layer) uses TLS encryption like SSL but differs in its authentication process. Sep 10, 2021 · SSL failed handshake in Kafka Broker after upgrade. kafka-operator1. 2 Handshake, length = 80. You can do this by inspecting the certificates in the `/etc/kafka/ssl` directory. I am using config for connection: var configSSL = new ConsumerConfig {. x and 2. 4. [kafka-admin-client-thread | adminclient-1] ERROR org. Aug 4, 2020 · Trying to produce some data using my Kafka producer application, but i get below error: [SocketServer brokerId=0] Failed authentication with localhost/127. kafka-producer-network-thread | console-producer, READ: TLSv1. sh and kafka-console-producer. When I tried to run the container it starts but can't communicate with any broker due to SSL handshake failed. Note that openshift service is port forwarding message to 9043. Is initial handshake: true. keytool -keystore server. mechanism", "PLAINTEXT"); by. jks -alias localhost -validity 365 -genkey. When I ran with let's encrypt production, it worked fine. pem" to allow the client to load the appropriate certificates or including the intermediate Certificate Authorities from the windows store would fix my issue. Terminology. It’s important to note that, due to security vulnerabilities, Transport Layer Security (TLS) supersedes SSL as a standard. jks -destkeystore server. 2022-12-07 05:51:22,307 INFO [SocketServer listenerType Oct 6, 2020 · Tutorial covering authentication using SCRAM, authorization using Kafka ACL, encryption using SSL, and using camel-Kafka to produce/consume messages. mechanism which is not a valid setting. ユーザー登録後、kafkaを起動させます。. Closed. Jun 18, 2019 · I'm testing kafka cluster creation using let's encrypt staging certs. Additionally, if you are using Confluent Control Center streams monitoring for Kafka Connect, configure security for: Confluent Monitoring Interceptors Mar 8, 2020 · Both kafka and schema registry is secured and uses https endpoints. apache. 测试环境. Aug 22, 2019 at 22:16. 1 on /127. 2. When using a Kafka 2. Configure the Connect workers by adding these properties in connect-distributed. 2 (bundling librdkafka v2. Looks like Kafka server closes the connection after receives Client Hello. 5. CertificateException: No subject alternative DNS name matching my-cluster-Kafka-external-bootstrap. $ docker-compose up -d Jul 31, 2022 · I am trying to access kafka topic on Windows locally via my Eclipse java code. この登録をしないと、broker-broker間通信用のユーザーが存在しないためkafkaが起動できません。. jks -alias test_client -certreq -file client-cert-file Kafka Connect REST: Kafka Connect exposes a REST API that can be configured to use TLS/SSL using additional properties; Configure security for Kafka Connect as described in the section below. I don't know if I miss some configuration. 0-RC2 in addition to Confluent. Create CA. Nov 22, 2004 · Kafka SSL handshake failed issue. 24 January 2023. A couple of next questions I have is Q1) In the logs, I have seen the exception - java. Selector - [Producer clientId=producer-1] Failed authentication with localhost/127. algorithm", this fixed it. I am making consumer in Asp. 3. Nov 16, 2023 · A note for the community Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request If you are interested in working on this issue or have submitted a pull request Jun 7, 2022 · 4 May 2023. ssl配置. jaas. identification Dec 31, 2019 · The answer is to be found in the configure script for the Confluent Kafka Docker image, which is executed by the entry point script. certificate. location(certificate. X:4848 --working. spring. Jan 10, 2022 · SSL Kafka handshake failed over docker #914. 11. sh work with configured SASL_PLAINTEXT authentication on the server. 13-2. So in this case the communication is established to the broker, broker sends cert but expects then the client cert. adminConfig. password = confluent producer. 629 [kafka-producer-network-thread | producer-1] ERROR o. given debug, you can add { "debug", "security" } in config to have logs related to ssl Oct 11, 2019 · I had same problem. Mar 7, 2020 · An SSL handshake between two Kafka brokers or between a Kafka broker and a client (for example, a producer or a consumer) works similar to a typical client-server SSL handshake Mar 11, 2024 · By default, Apache Kafka sends all data as clear text and without any authentication. Jun 13, 2022 · This may happen due to any of the following reasons: (1) Authentication failed due to invalid credentials with brokers older than 1. May 15, 2020 · Thanks for the information, it helped and worked with detailed logs in the console. sh scripts. Generate a Client Certificate and sign it using the CA. AuthenticationException: Authentication Dec 6, 2022 · Using strimzi operator 0. X:4848 --list Main important point , configure listeners with IP address in server. Feb 15, 2022 · SSL handshake:- Failed to process post-handshake messages. I used the official Jan 25, 2024 · In this tutorial, we’ll discuss various scenarios that can result in an SSL handshake failure and how to do it. Jun 29, 2017 · Can you try referencing nuget librdkafka. Ensure that the Kafka broker and client have the correct keystore and truststore files. Adding new config "ssl. Once the keystore configuration has been validated, you can use Java SSL Debug log to troubleshoot which cipher suites are being sent by the client. Close the connection with Ctrl+C. Nov 26, 2023 · ERROR Exiting Kafka due to fatal exception during startup. data-plane-kafka-network-thread-1-ListenerName(SSL)-SSL-1, fatal error: 80: problem unwrapping net record. protocol and where I have 2 listeners: SASL_PLAINTEXT and SSL. RELEASE) with Spring Kafka, using the same key and certificate. Then copy the certificate to the VM where the CA is running. Jun 9, 2015 · For me it was that I accidentally enabled ssl client auth: ssl. This is a server. sendBufferSize [actual|requested]: [102400|102400] recvBufferSize Feb 10, 2021 · You Ingress listener is configured with authentication: authentication : type: tls. network. Reload to refresh your session. 24. 3. mechanism", "PLAIN"); Based on this file extracted for the full example using the last kafka image, it seems that you need to authenticate the client as well using the CA certificate for both parts (CURL client and Kafka). Feb 27, 2023 · Since confluent-kafka-python 2. ConfigException: Invalid value javax. auth=required in kafka brokers. Modified 5 months ago. 0 introduced a change of behaviour related to the handling of SSL connections. 2 Handshake, length = 1978. Selector) This errors happens on each node, every few seconds, and on each message the IP in the message is the kafka broker IP. Selector)" 1 Kafka2. 生成SSL密钥和证书. RELEASE) with. Jan 30, 2024 · Step 1: Generating Keystores. keystore. Please give any advice to me. SSL handshake failed. 0: Whenever kafka cluster is deployed using custom client or cluster certificate or both . 32. identification. Kafka$) org. 1:9092. telnet bootstrap-broker port-number. When the brokers connect and do the handshake, the client (= the broker which is opening connection) needs to verify the identity Then we’ll open an SSL connection with our kafka-1 broker to verify that things are working: openssl s_client -connect localhost:19093 -tls1_3 -showcerts. 8. Be sure to do the following: Replace bootstrap-broker with one of the broker addresses from your Amazon MSK Cluster. I get the below error: WARN Failed to send SSL Close Why do I receive an SSL handshake failure when using the Kafka 2. Feb 16, 2021 · Sorted by: 1.