Kafka multi-node cluster mTLS wildcard capability

Hi all,

I’m trying to use the same wild-card certificate for all three brokers for inter broker connection, but it’s not working. My implementation is implemented locally using docker. Anyone knows whether this is feasible or not? If it is, please provide an example, or point out the error. Thank you!

For docker-compose, I’m using this: cp-docker-images/docker-compose.yml at 5.1.0-post · confluentinc/cp-docker-images (github.com)

My steps for generating the certificate:

openssl req -new -x509 -keyout snakeoil-ca-1.key -out snakeoil-ca-1.crt -days 365 -subj ‘/CN=*.test.confluent.io/OU=TEST/O=CONFLUENT/L=PaloAlto/S=Ca/C=US’ -passin pass:confluent -passout pass:confluent

keytool -genkey -noprompt -alias broker -dname “CN=*.test.confluent.io, OU=TEST, O=CONFLUENT, L=PaloAlto, S=Ca, C=US” -keystore kafka.broker.keystore.jks -keyalg RSA -storepass confluent -keypass confluent

keytool -keystore kafka.broker.keystore.jks -alias broker -certreq -file “broker.csr” -storepass confluent -keypass confluent

openssl x509 -req -CA snakeoil-ca-1.crt -CAkey snakeoil-ca-1.key -in “broker.csr” -out “broker-ca1-signed.crt” -days 9999 -CAcreateserial -passin pass:confluent -extensions kafka_ca_extensions -extfile ./openssl.cnf

keytool -keystore kafka.broker.keystore.jks -alias CARoot -import -file snakeoil-ca-1.crt -storepass confluent -keypass confluent

keytool -keystore kafka.broker.keystore.jks -alias broker -import -file “broker-ca1-signed.crt” -storepass confluent -keypass confluent

keytool -keystore kafka.broker.truststore.jks -alias CARoot -import -file snakeoil-ca-1.crt -storepass confluent -keypass confluent

openssl.cnf is like this below:
[ kafka_ca_extensions ]
basicConstraints = CA:false
keyUsage = digitalSignature,keyEncipherment
extendedKeyUsage =
subjectAltName = @kafka_alt_names

[ kafka_alt_names ]
DNS.1 = test.confluent.io
DNS.2 = *.test.confluent.io

Here’s the error from docker:

Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)

org.apache.kafka.common.config.ConfigException: Invalid value javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed for configuration A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings.