SSL Connection Error: Hostname/IP doesn't match certificate's altnames

I’m using the Heroku kafka addon. The hosts are just ec2 hosts (eg. ec2-xxx-xxx-xxx-xxx.compute-1.amazonaws.com), but the certs CN is a random alpha string. Using "rejectUnauthorized": false works but then it does not verify the cert is signed by the provided CA. Is there any way to ignore the hostname match but keep all the rest of the verification?

[mbarany]

Adding the checkServerIdentity option. Example:

const kafkaOptions = {
  clientId: `...`,
  brokers: process.env.KAFKA_URL.split(',').map((host) => {
    return host.replace('kafka+ssl://', '');
  }),
  logLevel: logLevel.ERROR,
  ssl: {
    checkServerIdentity: () => undefined, // disables hostname verification only
    ca: [process.env.KAFKA_TRUSTED_CERT],
    key: process.env.KAFKA_CLIENT_CERT_KEY,
    cert: process.env.KAFKA_CLIENT_CERT
  }
};

const kafka = new Kafka(kafkaOptions);

[ethanresnick]

@mbarany Thanks. That’s what I ended up doing too.