一、搭建kafka
步骤忽略
二、使用keytool生成客户端和服务端证书
生成含有一个私钥的keystore文件
keytool -genkeypair -alias certificatekey -keyalg RSA -validity 3650 -keystore keystore.jks
查看生成的keystore文件
keytool -list -v -keystore keystore.jks
导出证书
keytool -export -alias certificatekey -keystore keystore.jks -rfc -file selfsignedcert.cer
导入证书到truststore文件中
keytool -import -alias certificatekey -file selfsignedcert.cer -keystore truststore.jks
查看生成的truststore文件
keytool -list -v -keystore truststore.jks
三、kafka配置ssl
1、config/server.properties
listeners=PLAINTEXT://192.168.10.133:9092,SSL://192.168.10.133:9093
ssl.keystore.location=/data/cert/test/keystore.jks
ssl.keystore.password=123456
ssl.truststore.location=/data/cert/test/truststore.jks
ssl.truststore.password=123456
ssl.client.auth=required
ssl.enabled.protocols=TLSv1.2
ssl.keystore.type=JKS
ssl.truststore.type=JKS
#关闭主机名
ssl.endpoint.identification.algorithm=
# 设置内部访问也用SSL，默认值为security.inter.broker.protocol=PLAINTEXT
security.inter.broker.protocol=SSL
2、config/producer.properties
#bootstrap.servers=localhost:9092
bootstrap.servers=192.168.10.133:9093
ssl.protocol=SSL
security.protocol=SSL
ssl.enabled.protocols=TLSv1.2
ssl.keystore.location=/data/cert/test/keystore.jks
ssl.keystore.password=123456
ssl.truststore.location=/data/cert/test/truststore.jks
ssl.truststore.password=123456
ssl.endpoint.identification.algorithm=
3、config/consumer.properties
#bootstrap.servers=localhost:9092
bootstrap.servers=192.168.10.133:9093
ssl.protocol=SSL
security.protocol=SSL
ssl.enabled.protocols=TLSv1.2
ssl.keystore.location=/data/cert/test/keystore.jks
ssl.keystore.password=123456
ssl.truststore.location=/data/cert/test/truststore.jks
ssl.truststore.password=123456
ssl.endpoint.identification.algorithm=
四、测试
1、启动服务
sh kafka-server-start.sh -daemon ../config/server.properties
ss -tulnp|grep java
2、测试ssl连接配置
openssl s_client -debug -connect 192.168.10.133:9093 -tls1_2
3、生产者
./kafka-console-producer.sh --broker-list 192.168.10.133:9093 --topic test --producer.config ../config/producer.properties
可以输入内容，最后按ctrl+d退出
4、消费者
./kafka-console-consumer.sh --bootstrap-server 192.168.10.133:9093 --topic test --from-beginning --consumer.config ../config/consumer.properties
