[ https://issues.apache.org/jira/browse/KAFKA-12534?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17343202#comment-17343202 ]
Jordan Moore commented on KAFKA-12534: -------------------------------------- According to this documentation, the listener name (in lowercase) "must" be used to set the ssl properties So, for listeners=SSL://:9093 {code} kafka-configs --command-config /etc/kafka/client.properties --bootstrap-server hostname:port --entity-type brokers --entity-name <broker-ID> --alter --add-config listener.name.ssl.ssl.keystore.location=<path-to-keystore.jks> {code} https://docs.confluent.io/platform/current/kafka/dynamic-config.html#updating-ssl-keystore-of-an-existing-listener > kafka-configs does not work with ssl enabled kafka broker. > ---------------------------------------------------------- > > Key: KAFKA-12534 > URL: https://issues.apache.org/jira/browse/KAFKA-12534 > Project: Kafka > Issue Type: Bug > Affects Versions: 2.6.1 > Reporter: kaushik srinivas > Priority: Critical > > We are trying to change the trust store password on the fly using the > kafka-configs script for a ssl enabled kafka broker. > Below is the command used: > kafka-configs.sh --bootstrap-server localhost:9092 --entity-type brokers > --entity-name 1001 --alter --add-config 'ssl.truststore.password=xxx' > But we see below error in the broker logs when the command is run. > {"type":"log", "host":"kf-2-0", "level":"INFO", > "neid":"kafka-cfd5ccf2af7f47868e83473408", "system":"kafka", > "time":"2021-03-23T12:14:40.055", "timezone":"UTC", > "log":\{"message":"data-plane-kafka-network-thread-1002-ListenerName(SSL)-SSL-2 > - org.apache.kafka.common.network.Selector - [SocketServer brokerId=1002] > Failed authentication with /127.0.0.1 (SSL handshake failed)"}} > How can anyone configure ssl certs for the kafka-configs script and succeed > with the ssl handshake in this case ? > Note : > We are trying with a single listener i.e SSL: -- This message was sent by Atlassian Jira (v8.3.4#803005)