Kafka TLS/SSL 설정

Broker 

# 키저장소 만들기
keytool -genkey -keyalg RSA -keystore kafka.server.keystore.jks -validity 3650 -storepass 'QWER!234' -keypass 'QWER!234' -dname 'CN=localhost' -storetype pkcs12

# 인증서 서명 요청(Certificate Singning Request) 만들기
keytool -keystore kafka.server.keystore.jks -certreq -file cert-file -storepass 'QWER!234' -keypass 'QWER!234'

# CA 서버로 CSR 전송
scp cert-file sshuser@HeadNode0_Name:~/ssl/

CA 서버(Broker 서버와 동일해도 무관)

# ca-cert, ca-key 파일 생성
openssl req -new -newkey rsa:4096 -days 3650 -x509 -subj "/CN=Kafka-Security-CA" -keyout ca-key -out ca-cert -nodes

# CSR 에 사인하기
openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-signed -days 3650 -CAcreateserial -passin pass:'QWER!234'

Broker 

# truststore 와 keystore에 CA 퍼블릭 인증서 추가
keytool -keystore kafka.server.truststore.jks -alias CARoot -import -file ca-cert -storepass 'QWER!234' -keypass 'QWER!234' -noprompt
keytool -keystore kafka.server.keystore.jks -alias CARoot -import -file ca-cert -storepass 'QWER!234' -keypass 'QWER!234' -noprompt
keytool -keystore kafka.server.keystore.jks -import -file cert-signed -storepass 'QWER!234' -keypass 'QWER!234' -noprompt

Client

keytool -genkey -keyalg RSA -keystore kafka.client.keystore.jks -validity 3650 -storepass 'QWER!234' -keypass 'QWER!234' -dname "CN=localhost" -storetype pkcs12
# 요청서 만들기
keytool -keystore kafka.client.keystore.jks -certreq -file client-cert-sign-req uest -storepass 'QWER!234' -keypass 'QWER!234'

CA 서버

# 서명하기
openssl x509 -req -CA ca-cert -CAkey ca-key -in client-cert-sign-request -out client-cert-signed -days 3650 -CAcreateserial -passin pass:'QWER!234'

keytool -keystore kafka.client.truststore.jks -alias CARoot -import -file ca-cert -storepass 'QWER!234' -keypass 'QWER!234' -noprompt
keytool -keystore kafka.client.keystore.jks -alias CARoot -import -file ca-cert -storepass 'QWER!234' -keypass 'QWER!234' -noprompt
keytool -keystore kafka.client.keystore.jks -import -file client-cert-signed -storepass 'QWER!234' -keypass 'QWER!234' -noprompt

Client

bin/kafka-topics.sh --create --topic topic1 --bootstrap-server localhost:9092 -partitions 1 --replication-factor 1
bin/kafka-console-producer.sh --bootstrap-server localhost:9093 --topic topic1 --producer.config config/client-ssl-auth.properties
bin/kafka-console-consumer.sh --bootstrap-server localhost:9093 --topic topic1 --consumer.config config/client-ssl-auth.properties --from-beginning