2016-11-25 475 views
2

我有一個3節點卡夫卡羣集(版本0.10.1.0)。我已按照kafka security documentation上的步驟操作。以下是我的一臺Kafka服務器的相關配置。卡夫卡控制器無法連接到經紀人

listeners=SSL://myhostname:9093 
security.inter.broker.protocol=SSL 
advertised.listeners=SSL://myhostname:9093 
# In order to enable hostname verification 
ssl.endpoint.identification.algorithm=HTTPS 

ssl.client.auth=required 

# certificate file locations 
ssl.keystore.location=/location/server1.keystore.jks 
ssl.keystore.password=changeit 
ssl.key.password=changeit 
ssl.truststore.location=/location/server.truststore.jks 
ssl.truststore.password=changeit 

# Supported TLS versions 
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1 

我爲我的所有Kafka服務器定義了3個不同的密鑰庫,並使用相同的CA對它們進行了簽名。當我啓動Kafka服務器時,控制器日誌不斷記錄以下警告日誌。

WARN [Controller-0-to-broker-2-send-thread], Controller 0's connection to broker host3:9093 (id: 2 rack: null) was unsuccessful (kafka.controller.RequestSendThread) 
java.io.IOException: Connection to host3:9093 (id: 2 rack: null) failed 
    at kafka.utils.NetworkClientBlockingOps$.awaitReady$1(NetworkClientBlockingOps.scala:83) 
    at kafka.utils.NetworkClientBlockingOps$.blockingReady$extension(NetworkClientBlockingOps.scala:93) 
    at kafka.controller.RequestSendThread.brokerReady(ControllerChannelManager.scala:230) 
    at kafka.controller.RequestSendThread.liftedTree1$1(ControllerChannelManager.scala:182) 
    at kafka.controller.RequestSendThread.doWork(ControllerChannelManager.scala:181) 
    at kafka.utils.ShutdownableThread.run(ShutdownableThread.scala:63) 
WARN [Controller-0-to-broker-0-send-thread], Controller 0's connection to broker host1:9093 (id: 0 rack: null) was unsuccessful (kafka.controller.RequestSendThread) 
java.io.IOException: Connection to host1:9093 (id: 0 rack: null) failed 
    at kafka.utils.NetworkClientBlockingOps$.awaitReady$1(NetworkClientBlockingOps.scala:83) 
    at kafka.utils.NetworkClientBlockingOps$.blockingReady$extension(NetworkClientBlockingOps.scala:93) 
    at kafka.controller.RequestSendThread.brokerReady(ControllerChannelManager.scala:230) 
    at kafka.controller.RequestSendThread.liftedTree1$1(ControllerChannelManager.scala:182) 
    at kafka.controller.RequestSendThread.doWork(ControllerChannelManager.scala:181) 
    at kafka.utils.ShutdownableThread.run(ShutdownableThread.scala:63) 
WARN [Controller-0-to-broker-1-send-thread], Controller 0's connection to broker host2:9093 (id: 1 rack: null) was unsuccessful (kafka.controller.RequestSendThread) 
java.io.IOException: Connection to host2:9093 (id: 1 rack: null) failed 
    at kafka.utils.NetworkClientBlockingOps$.awaitReady$1(NetworkClientBlockingOps.scala:83) 
    at kafka.utils.NetworkClientBlockingOps$.blockingReady$extension(NetworkClientBlockingOps.scala:93) 
    at kafka.controller.RequestSendThread.brokerReady(ControllerChannelManager.scala:230) 
    at kafka.controller.RequestSendThread.liftedTree1$1(ControllerChannelManager.scala:182) 
    at kafka.controller.RequestSendThread.doWork(ControllerChannelManager.scala:181) 
    at kafka.utils.ShutdownableThread.run(ShutdownableThread.scala:63) 

在我看來,比警告更嚴重。

你有什麼想法可能是什麼問題?

在此先感謝。

回答

4

我確定了問題,它是關於證書的創建。請參閱Confluent's documentation它說:

確保通用名稱(CN)正好與服務器的完全合格的 域名(FQDN)相匹配。客戶端將CN與 DNS域名進行比較,以確保它確實連接到所需的 服務器,而不是惡意的。

我重新生成證書,它的工作!

相關問題