Getting error : Failed to load SSL keystore /tmp/client.truststore.p12 of type PKCS12, when trying to produce messages, and kafka cluster has TLS enabled.

[Gulnaz2021]

Hi,

When am trying to produce message using the below command getting error:
org.apache.kafka.common.KafkaException: Failed to construct kafka producer
at org.apache.kafka.clients.producer.KafkaProducer.(KafkaProducer.java:432)
at org.apache.kafka.clients.producer.KafkaProducer.(KafkaProducer.java:298)
at kafka.tools.ConsoleProducer$.main(ConsoleProducer.scala:45)
at kafka.tools.ConsoleProducer.main(ConsoleProducer.scala)
Caused by: org.apache.kafka.common.KafkaException: org.apache.kafka.common.KafkaException: org.apache.kafka.common.KafkaException: Failed to load SSL keystore /tmp/client.truststore.p12 of type PKCS12
at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChannelBuilder.java:71)
at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:146)
at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:67)
at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:99)
at org.apache.kafka.clients.producer.KafkaProducer.newSender(KafkaProducer.java:450)
at org.apache.kafka.clients.producer.KafkaProducer.(KafkaProducer.java:421)
... 3 more

Command used to produce the message:
./bin/kafka-console-producer.sh --broker-list upgrade-cluster-kafka-bootstrap.do-qa-kafka.svc.cluster.local:9093 --topic topic1 \

--producer-property security.protocol=SSL
--producer-property ssl.truststore.type=PKCS12
--producer-property ssl.keystore.type=PKCS12
--producer-property ssl.truststore.password=1234567
--producer-property ssl.keystore.password=1234567
--producer-property ssl.truststore.location=/tmp/client.truststore.p12
--producer-property ssl.keystore.location=/tmp/consumer.keystore.p12

Kafka cluster listener configs:
listeners:
external:
authentication:
type: tls
tls: true
type: loadbalancer
plain: {}
tls:
authentication:
type: tls
authorization:
type: simple

Strimzi operator version 17, application version 2.4.0

Can I please get some help in this regard.

[scholzj]

I think you need to describe how did you created the truststore / keystore files.

[Gulnaz2021]

Steps to generate truststore:
1: kubectl get secrets -n ns upgrade-cluster-cluster-ca-cert -o jsonpath='{.data.ca.crt}' | base64 -id > ca.crt

2: keytool
-import
-file ca.crt
-keystore client.truststore.p12
-alias ca
-storepass 1234567
-noprompt

Steps to generate keystore:

1. kubectl get secrets -n ns user1 -o jsonpath='{.data.user.crt}' | base64 -id > user.crt

2. kubectl get secrets -n ns user1 -o jsonpath='{.data.user.key}' | base64 -id > user.key

3. openssl pkcs12 -export -in user.crt -inkey user.key -name user.p12 -password pass:1234567 -out consumer.p12

4. keytool -importkeystore -alias user.p12 -deststorepass 1234567 -destkeystore consumer.keystore.p12 -srcstorepass 1234567
   -srckeystore consumer.p12 -srcstoretype PKCS12 -deststoretype PKCS12

[scholzj]

The keytool command used to generate the truststore - are you sure it generates PKCS12 file? You do not seem to specify the store type there, so I would expect it to be maybe JKS? Also, The step 4 does not seem to be needed - you just convert PKCS12 to PKCS12?

[Gulnaz2021]

Yes, the keytool command used to generate the truststore - it generates PKCS12 file.