Page MenuHomePhabricator
Paste P17334

Confluent kafka python with SSL and hostname verification

Authored by dcausse on Sep 28 2021, 8:27 AM.
from confluent_kafka import Consumer
c = Consumer({
'bootstrap.servers': 'SSL://kafka-main1002.eqiad.wmnet:9093',
'security.protocol': 'SSL',
'': 'test-confluent',
'ssl.endpoint.identification.algorithm': 'HTTPS', # unset by default disabling hostname verification
'': '/etc/ssl/certs/ca-certificates.crt' # optional librdkafka seems to load it by default
meta = c.list_topics()

Event Timeline

failure is:

%3|1632817492.690|FAIL|rdkafka#consumer-1| [thrd:ssl://kafka-main1002.eqiad.wmnet:9093/bootstrap]: ssl://kafka-main1002.eqiad.wmnet:9093/bootstrap: SSL handshake failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed: broker certificate could not be verified, verify that is correctly configured or root CA certificates are installed (install ca-certificates package) (after 7ms in state SSL_HANDSHAKE, 1 identical error(s) suppressed)