Kafka mTLS Config Generator

The keytool and openssl commands for an mTLS client, and the config. The principal the broker derives is what your ACLs have to match.

mtls-setup.sh

updates as you type

Common mistakes

These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.

Assuming mTLS gives authorisation
The certificate establishes an identity. What that identity may do is ACLs, evaluated separately, and by default an authenticated principal can do nothing.
Instead:Grant ACLs to the principal derived from the certificate.
Ignoring ssl.principal.mapping.rules
Without mapping, the principal is the entire distinguished name including OU and O, so an ACL written for CN=app does not match.
Instead:Set the mapping rules, and check the resulting principal in the broker log.
Forgetting the certificates expire
Client and broker certificates expire on a date nobody diaried, and the failure is a cluster-wide authentication outage.
Instead:Track expiry and automate renewal before it becomes an incident.

With mTLS the certificate is the identity, and that is the difficulty

The handshake succeeding tells you nothing about whether the client is authorised.

The principal is the distinguished name unless you map it

The broker derives a principal from the client certificate's subject, which is the full DN including field order: CN=orders,O=example. Every ACL must match it exactly, so a certificate reissued with the fields in a different order silently loses all its permissions. ssl.principal.mapping.rules shortens it to just the CN, and that rule is the difference between a workable ACL scheme and one that breaks on every renewal.

Import the CA before the signed certificate

keytool cannot build a chain to an issuer it does not already hold, so importing them the other way round fails with a message about a reply not being trusted, which reads as though the certificate itself is bad. The order in the generated commands is deliberate.

The truststore holds the CA, not the broker certificate

Pinning the broker's own leaf certificate works until it is renewed, and then every client fails at once. The CA is the thing with the long life, and it is what lets a broker certificate be replaced without touching a single client.

ssl.client.auth=requested is not authentication

With requested rather than required, the broker accepts a connection that presents no client certificate, and that connection is ANONYMOUS. Any ACL granting ANONYMOUS applies to it, and if allow.everyone.if.no.acl.found is set it has full access. The setting that makes mTLS authentication rather than encryption is on the broker, not the client.

Expiry is a scheduled outage

On the day the client certificate expires, every client using it stops connecting, and the error is a handshake failure naming neither the certificate nor the expiry. Short validity is only safer than long if rotation is automated; otherwise it just makes the outage arrive sooner. The TLS decoder on this site reads a certificate's expiry without sending it anywhere.

More kafka tools

Kafka Confluent Wire Format Decoder The five junk bytes in front of your payload Kafka Key to Partition Mapper Which partition does this key land on? Kafka Topic Name Validator Legal, risky, or 249 characters too long? Kafka Replication Safety Checker How many brokers can you lose Kafka Producer Config Linter Will it start, and will it lose a record? Kafka Message Payload Decoder The first five bytes are usually not data Kafka Connect Source Connector Generator tasks.max is a ceiling, not a count Kafka Connect Sink Connector Generator A dead letter queue with no context headers is a pile of records Kafka Connect SMT Chain Builder The order is the transforms list Kafka MirrorMaker 2 Config Generator It renames every topic by default Kafka Partition Reassignment Generator The throttle is not optional Strimzi Kafka Resource Generator Without the cluster label, nothing happens Kafka Schema Registry Config Generator The compatibility direction is your deployment order Kafka Exactly-Once Config Generator Half of it is worse than none Kafka Broker and KRaft Config Generator The internal topics that break a one-broker cluster Kafka Quota Generator Byte rates are per broker, not per cluster Kafka Streams Config Generator application.id is four things at once Kafka Connect Worker Config Generator Security three times, or the tasks fail Kafka Retention and Unit Converter log.retention.hours does not take milliseconds Kafka Timestamp Converter Two sentinels and two meanings Kafka .properties to YAML Converter Dotted keys stay flat Kafka Streams Internal Topic Predictor Create them before Streams does Kafka ACL Generator The grant you forgot is on another resource type Kafka Topic Config Generator min.insync.replicas is the one that matters Kafka client.properties Generator The file every CLI tool asks for Kafka Producer Config Generator No password field, on purpose Kafka Consumer Config Generator The commit mode decides the semantics Kafka Disk and Retention Calculator retention.bytes is per partition Kafka Partition Count Calculator The number you can never reduce Kafka Cluster Sizing Calculator The traffic no client metric shows Kafka Consumer Lag Catch-Up Calculator Whether it ever clears, not just when Kafka Producer Batching Calculator linger.ms=0 still batches Kafka Segment and Index Sizing Why retention.ms is a lower bound Kafka Rebalance Duration Estimator What a rolling restart really costs Kafka Cost Estimator Your rates, so nothing goes stale Kafka Config Explorer by Version The answer depends on the release Kafka Default Config Reference What moved under a config you never edited Kafka OAuth Bearer Token Decoder Will Kafka accept it, and can it refresh Kafka Record Header Viewer Headers are a list, not a map Kafka Topic Regex Subscription Tester Kafka matches the whole name Kafka ACL Permission Matrix Viewer DENY beats every ALLOW Kafka Connect Config Validator The mistakes that raise no error Kafka Consumer Group Id Validator Which broker coordinates the group Kafka Partition Assignment Visualizer Leadership is the load, not replicas Kafka Consumer Assignment Visualizer The three assignors disagree Kafka ZooKeeper to KRaft Config Converter The authorizer class nobody changes Kafka Config to Strimzi Half of it belongs elsewhere Kafka Docker Compose Generator (KRaft) Reachable from inside and outside Kafka JAAS Config Decoder The line that stops SASL working Kafka CRC32C Calculator Which CRC, over which bytes Kafka Config Upgrade Checker What breaks when you upgrade Kafka Kafka Config Diff Which change actually changed something Kafka Consumer Config Linter Why the group rebalances, and where the records went Kafka Avro Schema Validator The defaults Avro accepts and rejects Kafka Schema Compatibility Checker What the registry will say, before you ask it Kafka Avro Schema Diff Which direction each change breaks Kafka Compression Comparison Measured on your bytes Kafka Delivery Semantics Exactly-once has a consumer half Kafka ksqlDB Query Builder It looks like SQL and the rules are not Kafka Connect SMT Predicate Tester negate reads backwards Kafka Streams Topology Viewer Count the repartitions Kafka Connect Pipeline Visualizer The order things really run in Kafka Protobuf Binary Decoder Works without the .proto Kafka Protobuf JSON Converter Why your JSON does not round-trip Kafka Protobuf to Avro Schema What does not survive the conversion Kafka Avro Binary Decoder Wrong schema, no error Kafka Avro JSON Converter Why the console producer rejects your line Kafka Avro Sample Data Generator Records that actually serialize Kafka JSON to Avro Schema What JSON cannot tell you Kafka JSON Schema to Avro What does not survive the conversion Kafka SASL JAAS Generator One login module, four syntaxes Kafka CLI Command Builder kcat is librdkafka, not Kafka

Elsewhere on the site

Terraform Validator & Formatter Kubernetes YAML Generator Kubernetes YAML Validator AWS IAM Policy Validator & Analyzer