Spring Kafka握手失败没有用于客户端身份验证的X.509证书，但我的密钥库中有一个

Question

我有一个我无法弄清楚的情况。我在K8s中的Springboot应用程序中运行，并尝试在我的公司内使用Spring Kafka从kafka主题消费，我必须使用SSL身份验证。

我已经赢得了我的信任

Alias name: 4f6b4855-0f06-4202-8531-cf0c8fbc6611
Creation date: Jun 28, 2022
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: C=xx, O=xxxx, CN=xxxxxx
Issuer: C=xx, L=xxx, O=xxxxxxxx, OU=xxxxxx, CN=xxxxxxx
Serial number: 7fbee1f1fb4c0721
Valid from: Thu Jun 23 08:34:51 GMT 2022 until: Fri Jun 23 08:34:51 GMT 2023
Certificate fingerprints:
         SHA1: 6A:27:FF:57:2B:5B:16:97:CA:7C:3B:CE:9D:E3:43:AF:B9:66:EC:AB
         SHA256: AD:96:34:4E:BD:BE:83:B8:5D:09:84:63:55:F0:E6:8A:15:CF:7A:35:6C:36:77:BF:FE:8B:68:A0:BE:61:7E:6B
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3
......

我的属性（是的，它是PKCS12密钥库，但是jks扩展）

spring.kafka.ssl.trust-store-location=file:/mnt/ssl/truststore.jks
spring.kafka.ssl.trust-store-password=changeit
spring.kafka.ssl.trust-store-type=PKCS12
spring.kafka.ssl.key-store-location=file:/mnt/ssl/keystore.jks
spring.kafka.ssl.key-store-password=changeit
spring.kafka.ssl.key-store-type=PKCS12

但是，当我的使用者开始时，我得到一个握手异常，从外观上看，它因为它无法提供客户端证书。这是证书请求（上面的证书是使用请求中提到的相同 CA 签名的）

javax.net.ssl|DEBUG|23|org.springframework.kafka.KafkaListenerEndpointContainer#0-0-C-1|2022-06-28 16:34:01.595 CEST|CertificateRequest.java:692|Consuming CertificateRequest handshake message (
"CertificateRequest": {
  "certificate types": [ecdsa_sign, rsa_sign, dss_sign]
  "supported signature algorithms": [ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384, ecdsa_secp521r1_sha512, rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, dsa_sha256, ecdsa_sha224, rsa_sha224, dsa_sha224, ecdsa_sha1, rsa_pkcs1_sha1, dsa_sha1]
  "certificate authorities": [C=xxxx, L=xxxxxx, O=xxxxxxx, OU=Axxxxx, CN=xxxxxx]
}

然而这是输出

javax.net.ssl|ALL|23|org.springframework.kafka.KafkaListenerEndpointContainer#0-0-C-1|2022-06-29 12:14:54.831 CEST|X509Authentication.java:246|No X.509 cert selected for RSA
javax.net.ssl|WARNING|23|org.springframework.kafka.KafkaListenerEndpointContainer#0-0-C-1|2022-06-29 12:14:54.831 CEST|CertificateRequest.java:809|Unavailable authentication scheme: rsa_pkcs1_sha256

.............

    javax.net.ssl|DEBUG|23|org.springframework.kafka.KafkaListenerEndpointContainer#0-0-C-1|2022-06-28 16:34:01.618 CEST|CertificateMessage.java:299|No X.509 certificate for client authentication, use empty Certificate message instead
    javax.net.ssl|DEBUG|23|org.springframework.kafka.KafkaListenerEndpointContainer#0-0-C-1|2022-06-28 16:34:01.619 CEST|CertificateMessage.java:330|Produced client Certificate handshake message (
    "Certificates": <empty list>
    )

我必须在这里遗漏一些在证书中不行的东西，但我不知道是什么。如果有人有任何线索，我很想听听

Answer 1

尝试删除密钥存储类型参数，并更改类似于

kafka.security.protocol=SSL
kafka.ssl.truststore.location=dir/xxxxx.jks
kafka.ssl.truststore.password=Password
kafka.ssl.keystore.location=dir/xxxxx.jks
kafka.ssl.keystore.password=Password
kafka.ssl.key.password=Password
kafka.ssl.enabled=true

此外，请确保KAFKA服务器在SSL上运行。

一旦你启动经纪人，你应该可以在server.log看到这样的东西，地址是： PLAINTEXT-

> < li>

要快速检查服务器密钥库和信任库是否设置正确，您可以运行以下命令

openssl s客户端-debug-connect本地主机：9093-tls1