question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

SSL servername needs to be set to leader broker host before connecting

See original GitHub issue

Whenever I tried accessing my SSL configured Kafka cluster externally, I always ran into a NotLeaderForPartition error. It looks like even though the correct host for the leader broker was found, the servername on the TLS socket established with the leader always remained the same one I originally set it to in the sslOptions:

const kafkaClientOptions = {
	brokers: ['<mybroker>'],
	ssl: {
		ca: fs.readFileSync('./kafkaCerts/ca.crt'),
		cert: fs.readFileSync('./kafkaCerts/user.crt'),
		key: fs.readFileSync('./kafkaCerts/user.key'),
		servername: '<mybroker>', //same as <mybroker> in brokers array above
	},
	logLevel: logLevel.ERROR,
};

I was poking around and found that I could solve this by setting the servername to the host after the leader was found and before I connected to it. I made this change locally in my node_modules in the broker class:

...
async connect() {
    try {
      await this.lock.acquire()

      if (this.isConnected()) {
        return
      }

      this.authenticated = false
      this.connection.ssl.servername = this.connection.host; // this is the line I added
      await this.connection.connect()
...

I’d like to make this change to the library myself as obviously updating a file in your node_modules is not a permanent solution.

Does anybody see an issue with me making this change?

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:5 (4 by maintainers)

github_iconTop GitHub Comments

1reaction
tulioscommented, Oct 1, 2019

I am closing this issue now; you can follow #503. Feel free to re-open if you need it.

0reactions
tulioscommented, Oct 2, 2019

@LibanAbukar pre-release 1.12.0-beta.1 was published with the change; you can update.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Why Can't I Connect to Kafka? | Troubleshoot Connectivity
My Python/Java/Spring/Go/Whatever Client Won't Connect to My Apache Kafka ... If the broker has not been configured correctly, the connections will fail.
Read more >
Kafka server SSL configuration exception - Stack Overflow
When the brokers connect and do the handshake, the client (= the broker which is opening connection) needs to verify the identity of...
Read more >
Unable to connect to Webservice through HTTP over SSL ...
I have configured broker truststore, added CA certificates to truststore and restarted the broker V8.0. I am getting below error message. User Trace...
Read more >
Documentation - Apache Kafka
advertised.host.name, Hostname to publish to ZooKeeper for clients to use. ... ssl.client.auth=required If set to required client authentication is required ...
Read more >
Broker Configs - Apache Kafka - CWIKI.US
NAME TYPE IMPORTANCE DYNAMIC UPDATE MODE zookeeper.connect string high read‑only advertised.host.name string high read‑only advertised.listeners string high per‑broker
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found