Kafka 入门实战(5)--安全协议

本文主要介绍 Kafka 中客户端（如 Producer、Consumer、AdminClient）与 Broker 之间，以及 Broker 节点相互通信时的安全协议，它决定了通信过程中的加密机制（Encryption）和身份验证方式（Authentication）；文中使用到的软件版本：Kafka 2.8.2、Java 1.8.0_341、Rocky Linux 9.5、OpenSSL 3.2.2。

1、协议说明

Kafka 支持 4 种协议：

协议 明文/加密 认证机制 适用场景/特点
PLAINTEXT 明文 无认证 默认选项。网络数据明文传输，无身份校验，仅适用于本地开发或绝对信任的内网环境。
SSL 加密 (TLS) 单向/双向TLS 证书 仅对数据传输进行 TLS/SSL 加密，可选是否校验客户端证书（双向认证）。配置简单，但开销相对较大。
SASL_PLAINTEXT 明文 SASL 认证 (如 GSSAPI, SCRAM) 客户端必须提供账号密码或 Kerberos 票据进行身份验证，但验证通过后的消息数据仍然以明文传输。
SASL_SSL 加密 (TLS) SASL 认证 + TLS 加密 生产环境推荐。既通过 SASL 进行强身份认证，又利用 TLS 加密传输全量流量，安全性最高。

当协议设为 SASL_PLAINTEXT 或 SASL_SSL 时，需要配合 sasl.enabled.mechanisms(服务端)、sasl.mechanism(客户端) 参数指定具体的认证算法：

  • PLAIN：简单账号密码认证（建议仅配合 SASL_SSL 使用，避免密码明文泄漏）。

  • SCRAM-SHA-256 / SCRAM-SHA-512：基于哈希加盐的账号密码认证，安全性高且配置比 Kerberos 轻量。

  • GSSAPI：基于 Kerberos 协议的单点登录/企业级身份认证。

  • OAUTHBEARER：基于 OAuth 2.0 Token 的认证。

2、证书准备

SSL 和 SASL_SSL 需要使用证书，这里使用 PEM 格式的正式，所有证书都通过 OpenSSL 生成。

#ca证书
openssl genrsa -out ca.key
openssl req -x509 -new -key ca.key -sha256 -days 3650 -out ca.pem

#服务端证书
openssl genrsa -out server.key
openssl req -new -key server.key -out server.csr -addext "subjectAltName = IP:10.49.196.30" 
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out server.pem -days 1000 -sha256 -copy_extensions copy

#客户端证书
openssl genrsa -out client.key
openssl req -new -key client.key -out client.csr
openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out client.pem -days 1000

#生成证书链
cat server.pem ca.pem > server-chain.pem
cat client.pem ca.pem > client-chain.pem

生成服务端证书时的参数：-addext "subjectAltName = IP:10.49.196.30" 及 -copy_extensions copy 是用于主机名的认证，如果客户端不验证主机名，则不需要这两个参数。

3、各协议配置实战

3.1、PLAINTEXT

该协议为 Kafak 的默认配置，无需额外操作。

3.2、SSL

3.2.1、Kafka 服务端配置

修改 config/server.properties 文件

listeners=PLAINTEXT://10.49.196.30:9092,SSL://10.49.196.30:9093
security.inter.broker.protocol=PLAINTEXT

ssl.keystore.type=PEM
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE-----\nMIIDjzCCAnegAwIBAgIUMpeGb+sU3Wq38BOZ87r3ujN0YwwDQYJKoZIhvcNAQEL\nBQAwVjELMAkGA1UEBhMQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAzMTMyNFoXDTM2MDkxMTAzMTMyNFowELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5HVyMQ0wCwYDVQQLDARu\nanp48wDQYDVQQDDAZzZXJ2ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQDCtpnWFRQ79eWFreYEwVfWB0sUGd4S1ND20nl8IUpGbBEISg8yq0Ti5LfP\nO7gpWY9wpGSKgjXCb7QK7ve2zIfbCqOB8sm5Co0XvREoSJ9JmwnhMCkO829vzF+P\nFusZ/7BADE3aHFTM5K/IK3h96Wv74be3JI+ahhn/DNfxTXQgT9FhJV37HPN+RonI\nG3ikK8Xwu1HPUHLtncYltdqkH3LJXTDKxpulpUc96z/PFy93nHNYTmBJM8LJUuV9\nQUogW2jAdMhOtuE4RaOkjxVAPB0Ip45Lztfx9EueFzTtTGfTUjdKvgI7XPQ19EdG\nMnHLjDKrapeKYC8cLW4xCvLg/xAgMBAAGjUzBRMA8GA1UdEQQIMAaHBAxB4w\nHQYDVR0OBEFPWVyBK/8jcUJ+u+6jju34EjT3HXMB8GA1UdIwQYMBaAFJuZiLTt\nvnWoWcugsOio37FJzxzKMA0GCSqGSIb3DQEBCwUAA4IBAQAcZoqcBxjP748u6sWY\nAjn+C5nRoOqnAiTdBid/0eyzj/lzZuSEMK5bI7fM3GOG0x7k0acewQ/TAmALeNh6\nPYXE0AvcbyuPQCK3RBPwztIUKhzC+4yDI/IxdioSV6kg2CQeyQWriODAW8wMCZYt\nGhs6D6gHc/O4VG2sz8d30nfP8VLIouFBtrEejqc+M+xyPvfh0ama9N7/OrldZps9\ncimM7BPEalPQTSKBCQGsdAEbLHWu6OWjOdW8guDxY8QTc9zZqmrb5LlHEQl3dbMB\np+slnB0X2ldfMb1arGSCajPe980BI2Sb1hkTYIEV+TmeFc+fUG9sVzxH4D9VGuou\nr/Mb\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDjTCCAnWgAwIBAgIUUmLvfZgiH2UauXA/LXZc5buXlwAwDQYJKoZIhvcNAQEL\nBQAwVLMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAyNDgxMFoXDTM2MDkxMTAyNDgxMFowVjELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ0wCwYDVQQDDARteWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAmbtBvxHdi1AMZm5AH277XT++8YKIAnk4RNbgeDm/oZVzsl9u9Mt+9gNf\ntIzGPOeaMQ9uRgkLxInutov5LH4QeqMCRCLhtNt067x5FBPBB18ygxSMXMGw\nPnwqAI3wrQKfkeFn2KWdZ1HXlujQ442woHPe07ofFkReMUdVC8gBu2re2XXw5+rg\nGF9363DrwbhNab7uTQ8+aNK92NwHDbjo3f9UOXF0Nj0UK4XFwONnaHYzMGExBF7\nK8rbGO4s7fHJa+ysuG1/k5GCsiRwRQCG0wLWwgvdvB44wicbtSWTvMylGaIF0plo\n/mXjwJkNTSsf9KlOtJBOjfAYxQIDAQABo1MwUTAdBgNVHQ4EFgQUm5mItO2+dahZ\ny6Cw6KjfsUnPHMowHwYDVR0jBBgwFoAUm5mItO2+dahZy6Cw6KjfsUnPHMowDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAVPXnzGVTx7UFJwlgzoru\n4Q4kcX7mjiHb5Dzsb7PSel+MG0tNc2HtxgR/NjO0UpP4WL80gt2+gmGmA9DNnsyk\nLIL8UNzCHSoPkM3Iu3Wvd+hyD1v7AWDtRxBwVYkA/EssrZPEA7HdODsDeJLmrO\niHENuDe3CnzeqZrTVKypXmw8o97Mviun/6S0yPGBmb8ehqjQGyGfv9KniIpBUJtn\n3T5jvuPEu/VXZhIffShH3Vx+zuPwISxiDMGDp4OOHbEZkZxLYx0oD89IfuwQE7dp\nXl87E7sLyi4RDhW6CVkzGzyGwEtuPeX7AkDvGhs5nT6tfnmURygqW+shVELB\nNg==\n-----END CERTIFICATE-----\n
ssl.keystore.key=-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBADCtpnWFRQ79eWF\nreYEwVfWB0sUGd4S1ND20nl8IUpGbBESg8yq0Ti5LfPO7gpWY9wpGSKgjXCb7QK\n7ve2zIfbCqOB8sm5Co0XvREoSJ9JmwnhMCkO829vzF+PFusZ/7BADE3aHFTM5K/I\nK3h96Wv74be3JI+ahhn/DNfxTXQgT9FhJV37HPN+RonIG3ikKwu1HPUHLtncYl\ntdqkH3LJXTDKxpulpUc96z/PFy93nHNYTmBJM8LJUuV9QUo2jAdMhOtuE4RaOk\njxVAPB0Ip45LztfxueFzTtTGfTUjdKvgI7XPQ19EdGMnHLjDKrasJpeKYC8cLW\n4xCvLg/xAgMBAAECggEAHbXfI1t0CvIqY4t1XaRi0rWqLxcDW7w9ZmwXPWmW+8fh\nkXI7f2/CwxxDL8vc/fI8gOOUs83KhjClOEXeZnYvBK1K5bk2LpX9kXG3/H2YUJLn\nnwTKPw3GIzj8G8lTdlQdgKhf+Lf5+ImsiM6ZRB0p7PU0Iy3g+6MatGAxUxCOd59y\nA9iliD4BEcVAuIKFN+M2m9CTrLXdoCQfwkFON9ketxN+VmaUavteOcMLoWVHMohB\n51dznLEku33asLMi0M/M20OyjTeaC4t7mmAGWYQ3jqj/k4lGSzHsoao+udZQ2rcg\nqjCmXnbG5nyK9QnJIdS/x0PmxCIxfNziCqD1inAQKBgQDsi5valopVNTSR4DNi\n2+sO7OWMidNPXHQWi5BfLcQkSabevfCBIy0/TnSm+guuK4xgLsHb9E/ZXXRQ\nzQsRdp/QuiBHH6cWtTVU7M86KWAGIlYqcMIntRiH9G5Qb14J10Z1+1ohRhpJ5OlL\nkYYmPx7XTks4XE4ckA9/6mYqjQKBgQDSujsKIOXwNhEV3SyL4+PGMe+WpYKY2CaQ\ni8zqFmSkqXe7j1WHNSBDT4xNZMJDEXHvyJNvaI6Jh4gCVLHZr2goT41X0CFFOnmA\n6Bb3yYd7lE7zKAQZhk9uXY4Gke3KxNMeQxm8Miherjo1dGpfrtBZh6VC9uc+KVfm\nzRkxcfJz9QKBgQCP8p2TtgzUsZ4eL7vVq1MuMAe5MJ0EIJh4+1sJTZHctDcqhg+g\neSIE1C1S2yGuA3hcM3AnkAy1F8YH1xFTopPbur6ivMGrxp1d+kRMPBgXotomoXqi\nNSBSHaiiA6OmGz+06WadoapFmW2iDkXSkOp8F+liyOiJkdKPGzPzeedWeQKBgQCq\nUPyw5gASkxBiFH4RnqIVKX0UzDbupB0fTO7U8D5t2867GFEvU5/850llsB9Wp73n\n6LxJGj/CJnmmMKAkQL+KgrpjuNwYI8ztjpcsf++NKKsvgFTb0N+ercl8znI4\nDlG5iuyYAcdoNuxW42rgQcMviXFDC5VRJMnM7eThFQKBgQCioddejmoGtHrdnWxK\nkTqlQ5s6f6G9aLrXY1s7saWE3le6r59qlAJdy40iHCkGzenhkzrgVPV84emA9lcj\noY5zEXUWmz7dJ42dKr+iN5Qr2tbGipafSkVj0eMJ3Rtvio5mNa4xuaRTZHq/nc4\nwXlvWdsMtB0xoD3khe5DpLg==\n-----END PRIVATE KEY-----\n

#验证客户端证书时需要如下参数
ssl.truststore.type=PEM
ssl.truststore.location=/home/mongo/cert/ca.pem
ssl.client.auth=required

注意：ssl.keystore.certificate.chain 和 ssl.keystore.key 参数配置的是证书内容，不是证书的路径。为了方便配置，这里使用 awk 命令把证书的内容转成一行后再配置：

#对应 ssl.keystore.certificate.chain
shell> awk '{printf "%s\\n", $0}' server-chain.pem
#对应 ssl.keystore.key
shell> awk '{printf "%s\\n", $0}' server.key

下面客户端的证书也是类似的处理。

3.2.2、Kafka 客户端配置

新建 client.properties 配置文件：

security.protocol=SSL

#该参数设为空表示不进行主机名认证
#ssl.endpoint.identification.algorithm=

ssl.truststore.type=PEM
ssl.truststore.location=/home/mongo/cert/ca.pem

#如果服务端开启了验证客户端证书时需要如下参数
ssl.keystore.type=PEM
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE-----\nMIIDfjCCAmagAwIBAgIUMpe+sU3Wq38BO6Z87r3ujN0Y0wDQYJKoZIhvcNAQEL\nBQAwVjELMAkGA1UEBhMCQxCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDA2MDcwN1oXDTM2MDkxMTA2MDcwN1owWDELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ8wDQYDVQQDDAZjbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQC7QaYEKI4zSph7JRklvXpzgloi25QaqZVnbHktRb00b1nOh42O+Ia0mqD3\nFWD5eIFp2GjVagyDgCF6ZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcLpCAzr6kgRKz\nHViO2BfwLWLmq4w/0seuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4\nbsQZBAdbeHERDVA+FLwNnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wW\nt/9MTlCthUHbGNOeR3OoBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kB\nCdsd8E0mTlQC3jXYxUOX66CcguchAgMBAAGjQjBAMB0GA1UdDgQWBBSo9p/Yi96J\nTZvaiUYjD7zBo46IEzAfBgNVHSMEGDAWgBSbmYi07b51qFnLoLDoqN+xSc8cyjAN\nBgkqhkiG9w0BAQsFAAOCAQEAdXKdJhdmynWNnnFqAX4BKW7UQJQneuwxbV9QdTRF\nlybtI4ZugsoJTEnjzRnAKFKvh0JcgIIIjUhEFezfZEJ4frh3RoNQ9LDyi7/qu6tH\nScuhdRXsBvXwrPy0drGzdHWHnKtEKYDT35kqFNqvHdN84BRkYrofqrNC1ouE4zGV\nPX03ezm1SII+x8/bXq3eP9CM0yBJNG4WwzvJb/b+WFfLL84OepGU74MMfrR+r1vG\nDDJ+XvJZKy4jIJY3ZVsuFxOV6fFNQJtDU0dHF0FM3y443Hl4UcVY7N1DHtIMe06S\nkSisMtlXhF+TGWFmh7r8Tl6UIWgU1m5shaJVtrcacwEanw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDjTCCAnWgAwIBAgIUUmLvfZgiH2UauXA/LXZc5buXlwAwDQYJKoZIhcNAQEL\nBQAwVjELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAyNDgxMFoXDTM2MDkxMTAyNDgxMFowVjELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ0wCwYDVQQDDARteWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAmbtBvxHdi1AC/MZm5AH277XT++8YKIAnk4RNbgeDm/oZVzsl9u2P9Mt+9gNf\ntIzGPOeaMQ9uRgkLxInuKytov5LH4QeqsVMCRCLhtNt067x5FBPBB18ygxSMXMGw\nPnwqAI3wrQKfkeFn2KWdZ1HXlujQ442woHPe07ofFkReMUdVC8gBu2re2XXw5+rg\nGF9363DrwbThNab7uTQ8+aNK92NwHDbjo9UOXF0Nj0UK4XFwONnaHYzMGExBF7\nK8rbGO4s7fHJa+ysuG1/k5GCsiRwRQ0wLWwgvdvB44wicbtSWTvMylGaIF0plo\n/mXjwJkNTSsf9KlOtJBOjfAYxQIDAQABo1MwUTAdBgNVHQ4EFgQUm5mItO2+dahZ\ny6Cw6KjfsUnPHMowHwYDVR0jBBgwFoAUm5mItO2+dahZy6Cw6KjfsUnPHMowDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAVPXnzGVTx7UFJwlgzoru\n4Q4kcX7mjiHb5Dzsb7PSel+MG0tNc2HtxgR/NjO0UpP4WL80gt2+gmGmA9DNnsyk\nLIL8UNzCHSoPkM3Iu3Wvd+hyD1v7AWDtRxBwVYkA/EssrZPVOEA7HdODsDeJLmrO\niHENuDe3CnzeqZrTVKypXmw8o97Mviun/6S0yPGBmb8ehqjQGyGfv9KniIpBUJtn\n5jvuPEu/VXZhfShH3Vx+zuISxiDMGDp4OOHbEZkZxLYx0oD89IfuwQE7dp\nXl87E7sLyi4RDhW6CVkzGzyGwEtuPeX7AkDvGhs5LpnT6tfEvnmURygqW+shVELB\nNg==\n-----END CERTIFICATE-----\n
ssl.keystore.key=-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC7QaYEKI4zSph7\nJRklvXpzgloi25QaqZVnbHktRb00b1nOh42O+Ia0mqD3FWD5eIFp2GjVagyDgCF6\nZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcLpCAzr6kgRKzHViO2B9GfwLWLmq4w/0s\neuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4bsQZBAdbeHERDVA+FLwN\nnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wWt/9MTlCthUHbGNOeR3Oo\nBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kBCdsd8E0mTlQC3jXYxUOX\n66CcguchAgMBAAECgf82Xy7VW5vung+oXMfwgr62IM4LUQwFXI2vz3oKqzVFBGVk\nkqIyi/c7zv+Yv+05QVfRZI4YIWAh5hFg6p5jYYAAhnecdIfpQf+hBseq+fRxVY\nLtfGjuwhgq5AS4NV40xKxjhGwjOhqeemVykcD7OuSka96awms1b84SoNslO7ZD\nwVgIiZ3KPiXTexrZ8eUtiER8onlRAO2gj/iHMln3fyZSMQ8MBkFUByOOVXhbkvGR\nGnbR5hLrpckakQXmhVXtdPOvX3LAbAE9+iqakx5XYzKPZaSVa+BSRe2RezNuLQix\nPDSTXEHidrr6s4JAkDaoHhyV0Ke96QF0jGe666UCgYEA7lo5MiK2qxwbkKAZKnm0\nr5+x5XaFlhQnYBNuvtCqUNuRmwiCVVpP40U0RvoEH0GmvxxW47NHRAvNMC+loRZ/\nJHCM3crmRxWyiy1dyVkUqIubZ/OG5BUUBmEwwm8foibG51UxUICx1c0bERrpDTSv\nJyq2nz6bfvtq6d/edflmxrsCgYEAyR7xKPrFDJub3+Px9pzXrWjL5jpvwThauRZW\nwfvmmidtzPNlBhIJKLNnyx1FiS55iMFhH/XZ1rU2L9gVYAvBu1bwxScvyz5o+bVE\n1fV5O0c0xY93xPmop4zKlCfM7vCD+88MvgWmB8Dl61LZGLDBRDhxePJuqFGl1r0H\n6D4dIdMCgYEA1uxmPK4OlxZeSLgEWUerRN20FNwdsulzY+/B4a/Yk9aZYfl3RK2N\n8boaXJHfG6wgRp2wP9wNu+8EU5nzOOFHPj162Be4M4r+Fv+OXRvFRAG23TI7hPj4\nuJP02q5HEPj0S+6G7DdPpCExcegZE35ZHfEnAUr7/bGJg2AJgmlAjcCgYB7dI/q\nbMyqaZasP3sWu740xyBqibJx9ArUlJ7a4qryM4PWDA4WRNn0bvQmnShDBhE6XiIl\ngT+f6YqCoey1EWJxgfO3wc83vm6n4ZqIj+9D8Pi20NNfSTU67FSpzyif/2m1F6ql\ntkfteH5qDmgPHOj13IPjD0XX8o6PG2gQKpitWwKBgQC1Br6eUDJhyOsdG/IPnynZ\nBbsZod7nAkAFgOmAsf+Jhp7pv9SxuVYOHPz8x6yhugr/Q8Q11L+paV+DAkLRHmX2\n8LkHP2zdOh/6PNb7LEGEBns/+4yIfrqG+8Tx8c3wDMqiNzRnIIdGH6lqSPM6d/N8\nzhARHZQ9lzphUIrrrGixJQ==\n-----END PRIVATE KEY-----\n

 这里 ssl.keystore.certificate.chain 和 ssl.keystore.key 参数配置的是 client-chain.pem 和 client.key 的内容。命令行客户端使用时指定该参数：

./kafka-topics.sh --list --bootstrap-server 10.49.196.30:9093 --command-config ../config/client.properties
./kafka-console-consumer.sh --bootstrap-server 10.49.196.30:9093 --topic test --from-beginning  --consumer.config ../config/client.properties

3.2.3、Java 客户端配置

创建生产者或消费者时，配置对应的参数：

properties.put("bootstrap.servers", "10.49.196.30:9093");
properties.put(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, "SSL");
properties.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, "PEM");
properties.put(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG, "/home/mongo/cert/ca.pem");

//服务开启了客户端证书认证需要如下参数
properties.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, "PEM");
properties.put(SslConfigs.SSL_KEYSTORE_KEY_CONFIG, "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC7QaYEKI4zSph7\nJRklvXpzgloi25QaqZVnbtRb00b1nOh42O+Ia0mqD3FWD5eIFp2GjVagyDgCF6\nZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcCAzr6kgRKzHViO2B9GfwLWLmq4w/0s\neuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4bsQZBAdbeHERDVA+FLwN\nnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wWt/9MTlCthUHbGNOeR3Oo\nBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kBCdsd8E0mTlQC3jXYxUOX\n66CcguchAgMBAAECgf82Xy7VW5vung+oXMfwgr62IM4LUQwFXI2vz3oKqzVFBGVk\nkqIyi/7zv+YvvG+05QVfRZI4YIWAh5hFg6p5jYYhnecdIfpQf+hBseq+fRxVY\nLtfGjuwhgq5AqUS4NV40xKxjhwjOhqeemVykcD7OuSka96awms1b84SoNslO7ZD\nwVgIiZ3KPiXTexrZ8eUtiER8onlRAO2gj/iHMln3fyZSMQ8MBkFUByOOVXhbkvGR\nGnbR5hLrpckakQXmhVXtdPOvX3LAbAE9+iqakx5XYzKPZaSVa+BSRe2RezNuLQix\nPDSTXEHidrr6s4JAkDaoHhyV0Ke96QF0jGe666UCgYEA7lo5MiK2qxwbkKAZKnm0\nr5+x5XaFlhQnYBNuvtCqUNuRmwiCVVpP40U0RvoEH0GmvxxW47NHRAvNMC+loRZ/\nJHCM3crmRxWyiy1dyVkUqIubZ/OG5BUUBmEwwm8foibG51UxUICx1c0bERrpDTSv\nJyq2nz6bfvtq6d/edflmxrsCgYEAyR7xKPrFDJub3+Px9pzXrWjL5jpvwThauRZW\nwfvmmidtzPNlBhIJKLNnyx1FiS55iMFhH/XZ1rU2L9gVYAvBu1bwxScvyz5o+bVE\n1fV5O0c0xY93xPmop4zKlCfM7vCD+88MvgWmB8Dl61LZGLDBRDhxePJuqFGl1r0H\n6D4dIdMCgYEA1uxmPK4OlxZeSLgEWUerRN20FNwdsulzY+/B4a/Yk9aZYfl3RK2N\n8boaXJHfG6wgRp2wP9wNu+8EU5nzOOFHPj162Be4M4r+Fv+OXRvFRAG23TI7hPj4\nuJP02q5HEPj0S+6G7DdPpCExcegZE35ZHfEnAUr7/bGJg2AJgcmlAjcCgYB7dI/q\nbMyqaZasP3sWu740xyBqibJx9ArUlJ7a4qryM4PWDA4WRNn0bvQmnShDBhE6XiIl\ngT+f6YqCoey1EWJxgfO3wc83vm6n4ZqIj+9D8Pi20NNfSTU67FSpzyif/2m1F6ql\ntkfteH5qDmgPHOj13IPjD0XX8o6PG2gQKpitWwKBgQC1Br6eUDJhyOsdG/IPnynZ\nBbsZod7nAkAFgOmAsf+Jhp7pv9SxuVYOHPz8x6yhugr/Q8Q11L+paV+DAkLRHmX2\n8LkHPzdOh/6PNb7LEGEBns/+4yIfrqG+8Tx8c3wDMqiNzRnIGH6lqSPM6d/N8\nzhARH9lzphUIrrrGixJQ==\n-----END PRIVATE KEY-----\n");
properties.put(SslConfigs.SSL_KEYSTORE_CERTIFICATE_CHAIN_CONFIG, "-----BEGIN CERTIFICATE-----\nMIIDfjCCAmagAwIBAgIUMpeGb+sU3Wq38BO6Z87r3ujN0Y0wDQYJKoZIhvcNAQEL\nBQAwVjELMAA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDA2MDcwN1oXDTM2MDkxMTA2MDcwN1owWDELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ8wDQYDVQQDDAZjbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQC7QaYEKI4zSph7JRklvXpzgloi25QaqZVnbHktRb00b1nOh42O+Ia0mqD3\nFWD5eIFp2GjVyDgCF6ZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcLpCzr6kgRKz\nHViO2B9GfwLWLmq4w/0seuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4\nbsQZBAdbeHERDVA+FLwNnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wW\nt/9MTlCthUHbGNOeR3OoBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kB\nCdsd8E0mTlQC3jXYxUOX66CcguchAgMBAAGjQjBAMB0GA1UdDgQWBBSo9p/Yi96J\nTZvaiUYjD7zBo46IEzAfBgNVHSMEGDAWgBSbmYi07b51qFnLoLDoqN+xSc8cyjAN\nBgkqhkiG9w0BAQsFAAOCAQEAdXKdJhdmynWNnnFqAX4BKW7UQJQneuwxbV9QdTRF\nlybtI4ZugsoJTEnjzRnAKFKvh0JcgIIIjUhEFezfZEJ4frh3RoNQ9LDyi7/qu6tH\nScuhdRXsBvXwrPy0drGzdHWHnKtEKYDT35kqFNqvHdN84BRkYrofqrNC1ouE4zGV\nPX03ezm1SII+x8/bXq3eP9CM0yBJNG4WwzvJb/b+WFfLL84OepGU74MMfrR+r1vG\nDDJ+XvJZKy4jIJY3ZVsuFxOV6fFNQJtDU0dHF0FM3y443Hl4UcVY7N1DHtIMe06S\nkSisMtlXhF+TGWFmh7r8Tl6UIWgU1m5shaJVtrcacwEanw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDjTCCAnWgAwIBAgIUUmLvfZgiH2UauXA/LXZc5buXlwAwDQYJKoZIhvcNAQEL\nBQAwVjELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAyNDgxMFoXDTM2MDkxMTAyNDgxMFowVjELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ0wCwYDVQQDDARteWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAmbtBvxHdi1AC/MZm5AH277XT++8YKIAnk4RNbgeDm/oZVzsl9u2P9Mt+9gNf\ntIzGPOeaMQ9uRgkLxInuKytov5LH4QeqsVMCRCLhtNt067x5FBPBB18ygxSMXMGw\nPnwqAI3wrQKfkeFn2KWdZ1HXlujQ442woHPe07ofFkReMUdVC8gBu2re2XXw5+rg\nGF9363DrwbThNab7uTQ8+aNK92NwHDbjo3f9UOXF0Nj0UK4XFwONnaHYzMGExBF7\nK8rbGO4s7fHJa+ysuG1/k5GCsiRwRQCG0wLWwgvdvB44wicbtSWTvMylGaIF0plo\n/mXjwJkNTSsf9KlOtJBOjfAYxQIDAQABo1MwUTAdBgNVHQ4EFgQUm5mItO2+dahZ\ny6Cw6KjfsUnPHMowHwYDVR0jBBgwFoAUm5mItO2+dahZy6Cw6KjfsUnPHMowDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAVPXnzGVTx7UFJwlgzoru\n4Q4kcX7mjiHb5Dzsb7PSel+MG0tNc2HtxgR/NjO0UpP4WL80gt2+mGmA9DNnsyk\nLIL8NzCHSoPkM3Iu3Wvd+hyD1v7AWDtRxBwVYkA/EssrVOEA7HdODsDeJLmrO\niHENuDe3CnzeqZrTVKypXmw8o97Mviun/6S0yPGBmb8ejQGyGfv9KniIpBUJtn\n3T5jvuPEu/VXZhIffShH3Vx+zuPwISxiDMGDp4OOHbEZkZxLYx0oD89IfuwQE7dp\nXl87E7sLyi4RDhW6CVkzGzyGwEtuPeX7AkDvGhs5LpnT6tfEvnmURygqW+shVELB\nNg==\n-----END CERTIFICATE-----\n");
//该参数实战为空表示不进行进行主机名认证
//props.put(SslConfigs.SSL_ENDPOINT_IDENTIFICATION_ALGORITHM_CONFIG, "");

3.3、SASL_PLAINTEXT

3.3.1、认证机制-PLAIN

3.3.1.1、Kafka 服务端配置

A、jaas 配置

Kafka 使用 Java 认证和授权服务（JAAS）进行 SASL 配置。新建 jaas 配置文件(kafka_server_jaas.conf)：

KafkaServer {
   org.apache.kafka.common.security.plain.PlainLoginModule required
   username="inter"
   password="inter123"
   user_admin="admin123"
   user_test="test123";
};

username 和 password 参数用户 broker 之间的通信；用户 admin 和 test 用户客户端和 broker 之间的通信。

在 kafka-server-start.sh 启动脚本的倒数第二行新增：

export KAFKA_OPTS="-Djava.security.auth.login.config=/home/mongo/soft/kafka_2.13-2.8.2/config/kafka_server_jaas.conf"

B、server.properties 配置

listeners=PLAINTEXT://10.49.196.30:9092,SASL_PLAINTEXT://10.49.196.30:9094
security.inter.broker.protocol=PLAINTEXT
sasl.enabled.mechanisms=PLAIN
3.3.1.2、Kafka 客户端配置

新建 client.properties 配置文件：

security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN

sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin123";

request.timeout.ms=200000

命令行客户端使用时指定该参数：

./kafka-topics.sh --list --bootstrap-server 10.49.196.30:9094 --command-config ../config/client.properties
3.3.1.3、Java 客户端配置
properties.put("bootstrap.servers", "10.49.196.30:9094");
properties.setProperty(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, "SASL_PLAINTEXT");
properties.setProperty(SaslConfigs.SASL_MECHANISM, "PLAIN");
properties.setProperty(SaslConfigs.SASL_JAAS_CONFIG, "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"admin\" password=\"admin123\";");

3.3.2、认证机制-SCRAM-SHA-256/SCRAM-SHA-512

和 3.3.1 的配置步骤类似。

3.3.2.1、Kafka 服务端配置

A、jaas 配置

KafkaServer {
   org.apache.kafka.common.security.scram.ScramLoginModule required
   username="inter"
   password="inter123"
   user_admin="admin123"
   user_test="test123";
};

B、server.properties 配置

listeners=PLAINTEXT://10.49.196.30:9092,SASL_PLAINTEXT://10.49.196.30:9094
security.inter.broker.protocol=PLAINTEXT
sasl.enabled.mechanisms=SCRAM-SHA-256

C、创建SCRAM 用户凭证

./kafka-configs.sh --bootstrap-server 10.49.196.49:9092 --entity-type users --entity-name admin --alter --add-config 'SCRAM-SHA-256=[password=admin123]'
3.3.2.2、Kafka 客户端配置
security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-256

sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="admin123";

request.timeout.ms=200000
3.3.2.3、Java 客户端配置
properties.put("bootstrap.servers", "10.49.196.30:9094");
properties.setProperty(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, "SASL_PLAINTEXT");
properties.setProperty(SaslConfigs.SASL_MECHANISM, "SCRAM-SHA-256");
properties.setProperty(SaslConfigs.SASL_JAAS_CONFIG, "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"admin123\";");

3.3.3、认证机制-GSSAPI

 这是基于 Kerberos 的认证，具体使用可参考：Kafka 入门实战(4)--开启 Kerberos 认证。

3.3.4、认证机制-OAUTHBEARER

暂不讨论。

3.4、SASL_SSL

这就是 SASL 和 SSL 的结合，分别加上两者的配置即可。这里仅演示 PLAIN 的认证机制，其他类似配置。

3.4.1、Kafka 服务端配置

A、jaas 配置

KafkaServer {
   org.apache.kafka.common.security.plain.PlainLoginModule required
   username="inter"
   password="inter123"
   user_admin="admin123"
   user_test="test123";
};

B、server.properties 配置

listeners=PLAINTEXT://10.49.196.30:9092,SASL_SSL://10.49.196.30:9095
security.inter.broker.protocol=PLAINTEXT
sasl.enabled.mechanisms=PLAIN

ssl.keystore.type=PEM
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE-----\nMIIDjzCCAnegAwIBAgIUMpeGb+sU3Wq38BOZ87r3ujN0YwwDQYJKoZIhvcNAQEL\nBQAwVjELMAkGA1UEBhMQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAzMTMyNFoXDTM2MDkxMTAzMTMyNFowELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5HVyMQ0wCwYDVQQLDARu\nanp48wDQYDVQQDDAZzZXJ2ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQDCtpnWFRQ79eWFreYEwVfWB0sUGd4S1ND20nl8IUpGbBEISg8yq0Ti5LfP\nO7gpWY9wpGSKgjXCb7QK7ve2zIfbCqOB8sm5Co0XvREoSJ9JmwnhMCkO829vzF+P\nFusZ/7BADE3aHFTM5K/IK3h96Wv74be3JI+ahhn/DNfxTXQgT9FhJV37HPN+RonI\nG3ikK8Xwu1HPUHLtncYltdqkH3LJXTDKxpulpUc96z/PFy93nHNYTmBJM8LJUuV9\nQUogW2jAdMhOtuE4RaOkjxVAPB0Ip45Lztfx9EueFzTtTGfTUjdKvgI7XPQ19EdG\nMnHLjDKrapeKYC8cLW4xCvLg/xAgMBAAGjUzBRMA8GA1UdEQQIMAaHBAxB4w\nHQYDVR0OBEFPWVyBK/8jcUJ+u+6jju34EjT3HXMB8GA1UdIwQYMBaAFJuZiLTt\nvnWoWcugsOio37FJzxzKMA0GCSqGSIb3DQEBCwUAA4IBAQAcZoqcBxjP748u6sWY\nAjn+C5nRoOqnAiTdBid/0eyzj/lzZuSEMK5bI7fM3GOG0x7k0acewQ/TAmALeNh6\nPYXE0AvcbyuPQCK3RBPwztIUKhzC+4yDI/IxdioSV6kg2CQeyQWriODAW8wMCZYt\nGhs6D6gHc/O4VG2sz8d30nfP8VLIouFBtrEejqc+M+xyPvfh0ama9N7/OrldZps9\ncimM7BPEalPQTSKBCQGsdAEbLHWu6OWjOdW8guDxY8QTc9zZqmrb5LlHEQl3dbMB\np+slnB0X2ldfMb1arGSCajPe980BI2Sb1hkTYIEV+TmeFc+fUG9sVzxH4D9VGuou\nr/Mb\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDjTCCAnWgAwIBAgIUUmLvfZgiH2UauXA/LXZc5buXlwAwDQYJKoZIhvcNAQEL\nBQAwVLMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAyNDgxMFoXDTM2MDkxMTAyNDgxMFowVjELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ0wCwYDVQQDDARteWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAmbtBvxHdi1AMZm5AH277XT++8YKIAnk4RNbgeDm/oZVzsl9u9Mt+9gNf\ntIzGPOeaMQ9uRgkLxInutov5LH4QeqMCRCLhtNt067x5FBPBB18ygxSMXMGw\nPnwqAI3wrQKfkeFn2KWdZ1HXlujQ442woHPe07ofFkReMUdVC8gBu2re2XXw5+rg\nGF9363DrwbhNab7uTQ8+aNK92NwHDbjo3f9UOXF0Nj0UK4XFwONnaHYzMGExBF7\nK8rbGO4s7fHJa+ysuG1/k5GCsiRwRQCG0wLWwgvdvB44wicbtSWTvMylGaIF0plo\n/mXjwJkNTSsf9KlOtJBOjfAYxQIDAQABo1MwUTAdBgNVHQ4EFgQUm5mItO2+dahZ\ny6Cw6KjfsUnPHMowHwYDVR0jBBgwFoAUm5mItO2+dahZy6Cw6KjfsUnPHMowDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAVPXnzGVTx7UFJwlgzoru\n4Q4kcX7mjiHb5Dzsb7PSel+MG0tNc2HtxgR/NjO0UpP4WL80gt2+gmGmA9DNnsyk\nLIL8UNzCHSoPkM3Iu3Wvd+hyD1v7AWDtRxBwVYkA/EssrZPEA7HdODsDeJLmrO\niHENuDe3CnzeqZrTVKypXmw8o97Mviun/6S0yPGBmb8ehqjQGyGfv9KniIpBUJtn\n3T5jvuPEu/VXZhIffShH3Vx+zuPwISxiDMGDp4OOHbEZkZxLYx0oD89IfuwQE7dp\nXl87E7sLyi4RDhW6CVkzGzyGwEtuPeX7AkDvGhs5nT6tfnmURygqW+shVELB\nNg==\n-----END CERTIFICATE-----\n
ssl.keystore.key=-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBADCtpnWFRQ79eWF\nreYEwVfWB0sUGd4S1ND20nl8IUpGbBESg8yq0Ti5LfPO7gpWY9wpGSKgjXCb7QK\n7ve2zIfbCqOB8sm5Co0XvREoSJ9JmwnhMCkO829vzF+PFusZ/7BADE3aHFTM5K/I\nK3h96Wv74be3JI+ahhn/DNfxTXQgT9FhJV37HPN+RonIG3ikKwu1HPUHLtncYl\ntdqkH3LJXTDKxpulpUc96z/PFy93nHNYTmBJM8LJUuV9QUo2jAdMhOtuE4RaOk\njxVAPB0Ip45LztfxueFzTtTGfTUjdKvgI7XPQ19EdGMnHLjDKrasJpeKYC8cLW\n4xCvLg/xAgMBAAECggEAHbXfI1t0CvIqY4t1XaRi0rWqLxcDW7w9ZmwXPWmW+8fh\nkXI7f2/CwxxDL8vc/fI8gOOUs83KhjClOEXeZnYvBK1K5bk2LpX9kXG3/H2YUJLn\nnwTKPw3GIzj8G8lTdlQdgKhf+Lf5+ImsiM6ZRB0p7PU0Iy3g+6MatGAxUxCOd59y\nA9iliD4BEcVAuIKFN+M2m9CTrLXdoCQfwkFON9ketxN+VmaUavteOcMLoWVHMohB\n51dznLEku33asLMi0M/M20OyjTeaC4t7mmAGWYQ3jqj/k4lGSzHsoao+udZQ2rcg\nqjCmXnbG5nyK9QnJIdS/x0PmxCIxfNziCqD1inAQKBgQDsi5valopVNTSR4DNi\n2+sO7OWMidNPXHQWi5BfLcQkSabevfCBIy0/TnSm+guuK4xgLsHb9E/ZXXRQ\nzQsRdp/QuiBHH6cWtTVU7M86KWAGIlYqcMIntRiH9G5Qb14J10Z1+1ohRhpJ5OlL\nkYYmPx7XTks4XE4ckA9/6mYqjQKBgQDSujsKIOXwNhEV3SyL4+PGMe+WpYKY2CaQ\ni8zqFmSkqXe7j1WHNSBDT4xNZMJDEXHvyJNvaI6Jh4gCVLHZr2goT41X0CFFOnmA\n6Bb3yYd7lE7zKAQZhk9uXY4Gke3KxNMeQxm8Miherjo1dGpfrtBZh6VC9uc+KVfm\nzRkxcfJz9QKBgQCP8p2TtgzUsZ4eL7vVq1MuMAe5MJ0EIJh4+1sJTZHctDcqhg+g\neSIE1C1S2yGuA3hcM3AnkAy1F8YH1xFTopPbur6ivMGrxp1d+kRMPBgXotomoXqi\nNSBSHaiiA6OmGz+06WadoapFmW2iDkXSkOp8F+liyOiJkdKPGzPzeedWeQKBgQCq\nUPyw5gASkxBiFH4RnqIVKX0UzDbupB0fTO7U8D5t2867GFEvU5/850llsB9Wp73n\n6LxJGj/CJnmmMKAkQL+KgrpjuNwYI8ztjpcsf++NKKsvgFTb0N+ercl8znI4\nDlG5iuyYAcdoNuxW42rgQcMviXFDC5VRJMnM7eThFQKBgQCioddejmoGtHrdnWxK\nkTqlQ5s6f6G9aLrXY1s7saWE3le6r59qlAJdy40iHCkGzenhkzrgVPV84emA9lcj\noY5zEXUWmz7dJ42dKr+iN5Qr2tbGipafSkVj0eMJ3Rtvio5mNa4xuaRTZHq/nc4\nwXlvWdsMtB0xoD3khe5DpLg==\n-----END PRIVATE KEY-----\n

#验证客户端证书时需要如下参数
ssl.truststore.type=PEM
ssl.truststore.location=/home/mongo/cert/ca.pem
ssl.client.auth=required

3.4.2、Kafka 客户端配置

security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin123";

request.timeout.ms=200000

#该参数设为空表示不进行主机名认证
#ssl.endpoint.identification.algorithm=

ssl.truststore.type=PEM
ssl.truststore.location=/home/mongo/cert/ca.pem

#如果服务端开启了验证客户端证书时需要如下参数
ssl.keystore.type=PEM
ssl.keystore.certificate.chain=-----BEGIN CERTIFICATE-----\nMIIDfjCCAmagAwIBAgIUMpe+sU3Wq38BO6Z87r3ujN0Y0wDQYJKoZIhvcNAQEL\nBQAwVjELMAkGA1UEBhMCQxCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDA2MDcwN1oXDTM2MDkxMTA2MDcwN1owWDELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ8wDQYDVQQDDAZjbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQC7QaYEKI4zSph7JRklvXpzgloi25QaqZVnbHktRb00b1nOh42O+Ia0mqD3\nFWD5eIFp2GjVagyDgCF6ZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcLpCAzr6kgRKz\nHViO2BfwLWLmq4w/0seuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4\nbsQZBAdbeHERDVA+FLwNnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wW\nt/9MTlCthUHbGNOeR3OoBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kB\nCdsd8E0mTlQC3jXYxUOX66CcguchAgMBAAGjQjBAMB0GA1UdDgQWBBSo9p/Yi96J\nTZvaiUYjD7zBo46IEzAfBgNVHSMEGDAWgBSbmYi07b51qFnLoLDoqN+xSc8cyjAN\nBgkqhkiG9w0BAQsFAAOCAQEAdXKdJhdmynWNnnFqAX4BKW7UQJQneuwxbV9QdTRF\nlybtI4ZugsoJTEnjzRnAKFKvh0JcgIIIjUhEFezfZEJ4frh3RoNQ9LDyi7/qu6tH\nScuhdRXsBvXwrPy0drGzdHWHnKtEKYDT35kqFNqvHdN84BRkYrofqrNC1ouE4zGV\nPX03ezm1SII+x8/bXq3eP9CM0yBJNG4WwzvJb/b+WFfLL84OepGU74MMfrR+r1vG\nDDJ+XvJZKy4jIJY3ZVsuFxOV6fFNQJtDU0dHF0FM3y443Hl4UcVY7N1DHtIMe06S\nkSisMtlXhF+TGWFmh7r8Tl6UIWgU1m5shaJVtrcacwEanw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDjTCCAnWgAwIBAgIUUmLvfZgiH2UauXA/LXZc5buXlwAwDQYJKoZIhcNAQEL\nBQAwVjELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAyNDgxMFoXDTM2MDkxMTAyNDgxMFowVjELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ0wCwYDVQQDDARteWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAmbtBvxHdi1AC/MZm5AH277XT++8YKIAnk4RNbgeDm/oZVzsl9u2P9Mt+9gNf\ntIzGPOeaMQ9uRgkLxInuKytov5LH4QeqsVMCRCLhtNt067x5FBPBB18ygxSMXMGw\nPnwqAI3wrQKfkeFn2KWdZ1HXlujQ442woHPe07ofFkReMUdVC8gBu2re2XXw5+rg\nGF9363DrwbThNab7uTQ8+aNK92NwHDbjo9UOXF0Nj0UK4XFwONnaHYzMGExBF7\nK8rbGO4s7fHJa+ysuG1/k5GCsiRwRQ0wLWwgvdvB44wicbtSWTvMylGaIF0plo\n/mXjwJkNTSsf9KlOtJBOjfAYxQIDAQABo1MwUTAdBgNVHQ4EFgQUm5mItO2+dahZ\ny6Cw6KjfsUnPHMowHwYDVR0jBBgwFoAUm5mItO2+dahZy6Cw6KjfsUnPHMowDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAVPXnzGVTx7UFJwlgzoru\n4Q4kcX7mjiHb5Dzsb7PSel+MG0tNc2HtxgR/NjO0UpP4WL80gt2+gmGmA9DNnsyk\nLIL8UNzCHSoPkM3Iu3Wvd+hyD1v7AWDtRxBwVYkA/EssrZPVOEA7HdODsDeJLmrO\niHENuDe3CnzeqZrTVKypXmw8o97Mviun/6S0yPGBmb8ehqjQGyGfv9KniIpBUJtn\n5jvuPEu/VXZhfShH3Vx+zuISxiDMGDp4OOHbEZkZxLYx0oD89IfuwQE7dp\nXl87E7sLyi4RDhW6CVkzGzyGwEtuPeX7AkDvGhs5LpnT6tfEvnmURygqW+shVELB\nNg==\n-----END CERTIFICATE-----\n
ssl.keystore.key=-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC7QaYEKI4zSph7\nJRklvXpzgloi25QaqZVnbHktRb00b1nOh42O+Ia0mqD3FWD5eIFp2GjVagyDgCF6\nZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcLpCAzr6kgRKzHViO2B9GfwLWLmq4w/0s\neuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4bsQZBAdbeHERDVA+FLwN\nnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wWt/9MTlCthUHbGNOeR3Oo\nBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kBCdsd8E0mTlQC3jXYxUOX\n66CcguchAgMBAAECgf82Xy7VW5vung+oXMfwgr62IM4LUQwFXI2vz3oKqzVFBGVk\nkqIyi/c7zv+Yv+05QVfRZI4YIWAh5hFg6p5jYYAAhnecdIfpQf+hBseq+fRxVY\nLtfGjuwhgq5AS4NV40xKxjhGwjOhqeemVykcD7OuSka96awms1b84SoNslO7ZD\nwVgIiZ3KPiXTexrZ8eUtiER8onlRAO2gj/iHMln3fyZSMQ8MBkFUByOOVXhbkvGR\nGnbR5hLrpckakQXmhVXtdPOvX3LAbAE9+iqakx5XYzKPZaSVa+BSRe2RezNuLQix\nPDSTXEHidrr6s4JAkDaoHhyV0Ke96QF0jGe666UCgYEA7lo5MiK2qxwbkKAZKnm0\nr5+x5XaFlhQnYBNuvtCqUNuRmwiCVVpP40U0RvoEH0GmvxxW47NHRAvNMC+loRZ/\nJHCM3crmRxWyiy1dyVkUqIubZ/OG5BUUBmEwwm8foibG51UxUICx1c0bERrpDTSv\nJyq2nz6bfvtq6d/edflmxrsCgYEAyR7xKPrFDJub3+Px9pzXrWjL5jpvwThauRZW\nwfvmmidtzPNlBhIJKLNnyx1FiS55iMFhH/XZ1rU2L9gVYAvBu1bwxScvyz5o+bVE\n1fV5O0c0xY93xPmop4zKlCfM7vCD+88MvgWmB8Dl61LZGLDBRDhxePJuqFGl1r0H\n6D4dIdMCgYEA1uxmPK4OlxZeSLgEWUerRN20FNwdsulzY+/B4a/Yk9aZYfl3RK2N\n8boaXJHfG6wgRp2wP9wNu+8EU5nzOOFHPj162Be4M4r+Fv+OXRvFRAG23TI7hPj4\nuJP02q5HEPj0S+6G7DdPpCExcegZE35ZHfEnAUr7/bGJg2AJgmlAjcCgYB7dI/q\nbMyqaZasP3sWu740xyBqibJx9ArUlJ7a4qryM4PWDA4WRNn0bvQmnShDBhE6XiIl\ngT+f6YqCoey1EWJxgfO3wc83vm6n4ZqIj+9D8Pi20NNfSTU67FSpzyif/2m1F6ql\ntkfteH5qDmgPHOj13IPjD0XX8o6PG2gQKpitWwKBgQC1Br6eUDJhyOsdG/IPnynZ\nBbsZod7nAkAFgOmAsf+Jhp7pv9SxuVYOHPz8x6yhugr/Q8Q11L+paV+DAkLRHmX2\n8LkHP2zdOh/6PNb7LEGEBns/+4yIfrqG+8Tx8c3wDMqiNzRnIIdGH6lqSPM6d/N8\nzhARHZQ9lzphUIrrrGixJQ==\n-----END PRIVATE KEY-----\n

3.4.3、Java 客户端配置

properties.put("bootstrap.servers", "10.49.196.30:9095");
properties.put(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, "SASL_SSL");
properties.setProperty(SaslConfigs.SASL_MECHANISM, "PLAIN");
properties.setProperty(SaslConfigs.SASL_JAAS_CONFIG, "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"admin\" password=\"admin123\";");

properties.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, "PEM");
properties.put(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG, "/home/mongo/cert/ca.pem");

//服务开启了客户端证书认证需要如下参数
properties.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, "PEM");
properties.put(SslConfigs.SSL_KEYSTORE_KEY_CONFIG, "-----BEGIN PRIVATE KEY-----\nMIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC7QaYEKI4zSph7\nJRklvXpzgloi25QaqZVnbtRb00b1nOh42O+Ia0mqD3FWD5eIFp2GjVagyDgCF6\nZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcCAzr6kgRKzHViO2B9GfwLWLmq4w/0s\neuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4bsQZBAdbeHERDVA+FLwN\nnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wWt/9MTlCthUHbGNOeR3Oo\nBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kBCdsd8E0mTlQC3jXYxUOX\n66CcguchAgMBAAECgf82Xy7VW5vung+oXMfwgr62IM4LUQwFXI2vz3oKqzVFBGVk\nkqIyi/7zv+YvvG+05QVfRZI4YIWAh5hFg6p5jYYhnecdIfpQf+hBseq+fRxVY\nLtfGjuwhgq5AqUS4NV40xKxjhwjOhqeemVykcD7OuSka96awms1b84SoNslO7ZD\nwVgIiZ3KPiXTexrZ8eUtiER8onlRAO2gj/iHMln3fyZSMQ8MBkFUByOOVXhbkvGR\nGnbR5hLrpckakQXmhVXtdPOvX3LAbAE9+iqakx5XYzKPZaSVa+BSRe2RezNuLQix\nPDSTXEHidrr6s4JAkDaoHhyV0Ke96QF0jGe666UCgYEA7lo5MiK2qxwbkKAZKnm0\nr5+x5XaFlhQnYBNuvtCqUNuRmwiCVVpP40U0RvoEH0GmvxxW47NHRAvNMC+loRZ/\nJHCM3crmRxWyiy1dyVkUqIubZ/OG5BUUBmEwwm8foibG51UxUICx1c0bERrpDTSv\nJyq2nz6bfvtq6d/edflmxrsCgYEAyR7xKPrFDJub3+Px9pzXrWjL5jpvwThauRZW\nwfvmmidtzPNlBhIJKLNnyx1FiS55iMFhH/XZ1rU2L9gVYAvBu1bwxScvyz5o+bVE\n1fV5O0c0xY93xPmop4zKlCfM7vCD+88MvgWmB8Dl61LZGLDBRDhxePJuqFGl1r0H\n6D4dIdMCgYEA1uxmPK4OlxZeSLgEWUerRN20FNwdsulzY+/B4a/Yk9aZYfl3RK2N\n8boaXJHfG6wgRp2wP9wNu+8EU5nzOOFHPj162Be4M4r+Fv+OXRvFRAG23TI7hPj4\nuJP02q5HEPj0S+6G7DdPpCExcegZE35ZHfEnAUr7/bGJg2AJgcmlAjcCgYB7dI/q\nbMyqaZasP3sWu740xyBqibJx9ArUlJ7a4qryM4PWDA4WRNn0bvQmnShDBhE6XiIl\ngT+f6YqCoey1EWJxgfO3wc83vm6n4ZqIj+9D8Pi20NNfSTU67FSpzyif/2m1F6ql\ntkfteH5qDmgPHOj13IPjD0XX8o6PG2gQKpitWwKBgQC1Br6eUDJhyOsdG/IPnynZ\nBbsZod7nAkAFgOmAsf+Jhp7pv9SxuVYOHPz8x6yhugr/Q8Q11L+paV+DAkLRHmX2\n8LkHPzdOh/6PNb7LEGEBns/+4yIfrqG+8Tx8c3wDMqiNzRnIGH6lqSPM6d/N8\nzhARH9lzphUIrrrGixJQ==\n-----END PRIVATE KEY-----\n");
properties.put(SslConfigs.SSL_KEYSTORE_CERTIFICATE_CHAIN_CONFIG, "-----BEGIN CERTIFICATE-----\nMIIDfjCCAmagAwIBAgIUMpeGb+sU3Wq38BO6Z87r3ujN0Y0wDQYJKoZIhvcNAQEL\nBQAwVjELMAA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDA2MDcwN1oXDTM2MDkxMTA2MDcwN1owWDELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ8wDQYDVQQDDAZjbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQC7QaYEKI4zSph7JRklvXpzgloi25QaqZVnbHktRb00b1nOh42O+Ia0mqD3\nFWD5eIFp2GjVyDgCF6ZDrVX//51xvLy9Jl9lcVbbWc2Vi+cKLcLpCzr6kgRKz\nHViO2B9GfwLWLmq4w/0seuMLXIg15k/rRX5eATpwATH4TvcvYaf355KjY4049BF4\nbsQZBAdbeHERDVA+FLwNnRZZMl5fdgyqbK7mUg0viinp2T7o0PWyQeD0/3KGp6wW\nt/9MTlCthUHbGNOeR3OoBsFzi8kheH2wqmi0RJPJwsxJH25Y4JN6HrV6hA/C/6kB\nCdsd8E0mTlQC3jXYxUOX66CcguchAgMBAAGjQjBAMB0GA1UdDgQWBBSo9p/Yi96J\nTZvaiUYjD7zBo46IEzAfBgNVHSMEGDAWgBSbmYi07b51qFnLoLDoqN+xSc8cyjAN\nBgkqhkiG9w0BAQsFAAOCAQEAdXKdJhdmynWNnnFqAX4BKW7UQJQneuwxbV9QdTRF\nlybtI4ZugsoJTEnjzRnAKFKvh0JcgIIIjUhEFezfZEJ4frh3RoNQ9LDyi7/qu6tH\nScuhdRXsBvXwrPy0drGzdHWHnKtEKYDT35kqFNqvHdN84BRkYrofqrNC1ouE4zGV\nPX03ezm1SII+x8/bXq3eP9CM0yBJNG4WwzvJb/b+WFfLL84OepGU74MMfrR+r1vG\nDDJ+XvJZKy4jIJY3ZVsuFxOV6fFNQJtDU0dHF0FM3y443Hl4UcVY7N1DHtIMe06S\nkSisMtlXhF+TGWFmh7r8Tl6UIWgU1m5shaJVtrcacwEanw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIDjTCCAnWgAwIBAgIUUmLvfZgiH2UauXA/LXZc5buXlwAwDQYJKoZIhvcNAQEL\nBQAwVjELMAkGA1UEBhMCQ04xCzAJBgNVBAgMAkpTMQswCQYDVQQHDAJOSjEPMA0G\nA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARuanp4MQ0wCwYDVQQDDARteWNhMB4XDTI2\nMDkxNDAyNDgxMFoXDTM2MDkxMTAyNDgxMFowVjELMAkGA1UEBhMCQ04xCzAJBgNV\nBAgMAkpTMQswYDVQQHDAJOSjEPMA0GA1UECgwGSW5zcHVyMQ0wCwYDVQQLDARu\nanp4MQ0wCwYDVQQDDARteWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAmbtBvxHdi1AC/MZm5AH277XT++8YKIAnk4RNbgeDm/oZVzsl9u2P9Mt+9gNf\ntIzGPOeaMQ9uRgkLxInuKytov5LH4QeqsVMCRCLhtNt067x5FBPBB18ygxSMXMGw\nPnwqAI3wrQKfkeFn2KWdZ1HXlujQ442woHPe07ofFkReMUdVC8gBu2re2XXw5+rg\nGF9363DrwbThNab7uTQ8+aNK92NwHDbjo3f9UOXF0Nj0UK4XFwONnaHYzMGExBF7\nK8rbGO4s7fHJa+ysuG1/k5GCsiRwRQCG0wLWwgvdvB44wicbtSWTvMylGaIF0plo\n/mXjwJkNTSsf9KlOtJBOjfAYxQIDAQABo1MwUTAdBgNVHQ4EFgQUm5mItO2+dahZ\ny6Cw6KjfsUnPHMowHwYDVR0jBBgwFoAUm5mItO2+dahZy6Cw6KjfsUnPHMowDwYD\nVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAVPXnzGVTx7UFJwlgzoru\n4Q4kcX7mjiHb5Dzsb7PSel+MG0tNc2HtxgR/NjO0UpP4WL80gt2+mGmA9DNnsyk\nLIL8NzCHSoPkM3Iu3Wvd+hyD1v7AWDtRxBwVYkA/EssrVOEA7HdODsDeJLmrO\niHENuDe3CnzeqZrTVKypXmw8o97Mviun/6S0yPGBmb8ejQGyGfv9KniIpBUJtn\n3T5jvuPEu/VXZhIffShH3Vx+zuPwISxiDMGDp4OOHbEZkZxLYx0oD89IfuwQE7dp\nXl87E7sLyi4RDhW6CVkzGzyGwEtuPeX7AkDvGhs5LpnT6tfEvnmURygqW+shVELB\nNg==\n-----END CERTIFICATE-----\n");
//该参数实战为空表示不进行进行主机名认证
//props.put(SslConfigs.SSL_ENDPOINT_IDENTIFICATION_ALGORITHM_CONFIG, "");

 

posted @ 2026-10-24 14:03  且行且码  阅读(10)  评论(0)    收藏  举报