SSL servername needs to be set to leader broker host before connecting
See original GitHub issueWhenever I tried accessing my SSL configured Kafka cluster externally, I always ran into a NotLeaderForPartition error. It looks like even though the correct host for the leader broker was found, the servername on the TLS socket established with the leader always remained the same one I originally set it to in the sslOptions:
const kafkaClientOptions = {
brokers: ['<mybroker>'],
ssl: {
ca: fs.readFileSync('./kafkaCerts/ca.crt'),
cert: fs.readFileSync('./kafkaCerts/user.crt'),
key: fs.readFileSync('./kafkaCerts/user.key'),
servername: '<mybroker>', //same as <mybroker> in brokers array above
},
logLevel: logLevel.ERROR,
};
I was poking around and found that I could solve this by setting the servername to the host after the leader was found and before I connected to it. I made this change locally in my node_modules in the broker class:
...
async connect() {
try {
await this.lock.acquire()
if (this.isConnected()) {
return
}
this.authenticated = false
this.connection.ssl.servername = this.connection.host; // this is the line I added
await this.connection.connect()
...
I’d like to make this change to the library myself as obviously updating a file in your node_modules is not a permanent solution.
Does anybody see an issue with me making this change?
Issue Analytics
- State:
- Created 4 years ago
- Comments:5 (4 by maintainers)
Top Results From Across the Web
Why Can't I Connect to Kafka? | Troubleshoot Connectivity
My Python/Java/Spring/Go/Whatever Client Won't Connect to My Apache Kafka ... If the broker has not been configured correctly, the connections will fail.
Read more >Kafka server SSL configuration exception - Stack Overflow
When the brokers connect and do the handshake, the client (= the broker which is opening connection) needs to verify the identity of...
Read more >Unable to connect to Webservice through HTTP over SSL ...
I have configured broker truststore, added CA certificates to truststore and restarted the broker V8.0. I am getting below error message. User Trace...
Read more >Documentation - Apache Kafka
advertised.host.name, Hostname to publish to ZooKeeper for clients to use. ... ssl.client.auth=required If set to required client authentication is required ...
Read more >Broker Configs - Apache Kafka - CWIKI.US
NAME TYPE IMPORTANCE DYNAMIC UPDATE MODE
zookeeper.connect string high read‑only
advertised.host.name string high read‑only
advertised.listeners string high per‑broker
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I am closing this issue now; you can follow #503. Feel free to re-open if you need it.
@LibanAbukar pre-release
1.12.0-beta.1
was published with the change; you can update.