Hi Gaurav, Yes this would be valuable information for cluster operators.
However considering this feature is not in a released JDK yet, I'd prefer leaving it out for now. Once it's available in a Java version we run in our CI, I'd be happy following up with a KIP to update the metrics. Thanks, Mickael On Sat, Oct 17, 2026 at 12:48 AM Aditya Kousik via dev <[email protected]> wrote: > > Hi Arnab, > > On AK5: > > Listing only the local JVM’s supported groups may be misleading because > > Kafka does not know the peer’s supported groups at that point. > > Sorry, I meant capturing the peer’s supported groups in a custom > KafkaException, not just the local supported groups. PKCS is notoriously > cryptic with its error codes (with useful diagnostic messages such as > “fatal_alert”, “PKIX invalid cert”/ “validation failed”) and this will be one > of them. I just wonder if we could bake some useful info into the failure to > help ops people get to the root a bit better. At the end of the day, if we’re > following the same guarantees that the rest of the SSL suite offers, as with > cipher.suites, then I’m ok with leaving this as is. > > -Aditya > > > On Oct 16, 2026, at 11:48, Arnab Nandy via dev <[email protected]> wrote: > > > > Listing only the local JVM’s supported groups may be misleading because > > Kafka does not know the peer’s supported groups at that point.
