测试环境搭建整套大数据系统（十九：kafka ssl）

一：生成配置cert

1.1 生成server keystore

keytool -keystore server.keystore.jks -alias kafka-server -validity 365 -keyalg RSA -genkey
1

查看

 keytool -list -keystore server.keystore.jks -v
1

1.2生成client keystore

keytool -keystore client.keystore.jks -alias kafka-client -validity 365 -keyalg RSA -genkey
1

查看

keytool -list -keystore client.keystore.jks -v
1

1.3 生成CA证书

openssl req -new -x509 -keyout ca.key -out ca.crt -days 365
1

1.4 将 CA 证书导入到服务器和客户端的信任库中

 keytool -keystore server.trustkeystore.jks -alias CARoot -import -file ca.crt
1

keytool -keystore client.trustkeystore.jks -alias CARoot -import -file ca.crt
1

1.5 导出证书

keytool -keystore server.keystore.jks -alias kafka-server -certreq -file kafka.server.crt 
1

keytool -keystore client.keystore.jks -alias kafka-client -certreq -file kafka.client.crt  
1

1.6使用 CA 证书进行签名任务

openssl x509 -req -CA ca.crt -CAkey ca.key -in kafka.server.crt -out kafka.server.signed.crt -days 365 -CAcreateserial
1

openssl x509 -req -CA ca.crt -CAkey ca.key -in kafka.client.crt -out kafka.client.signed.crt -days 365 -CAcreateserial 
1

1.7 将 CA 证书导入到服务器和客户端的密钥库中

keytool -keystore server.keystore.jks -alias CARoot -import -file ca.crt
1

keytool -keystore client.keystore.jks -alias CARoot -import -file ca.crt 
1

1.8 在 CA 证书签名后，将证书导入到服务器和客户端的密钥库中

keytool -keystore server.keystore.jks -alias kafka-server -import -file kafka.server.signed.crt
1

keytool -keystore client.keystore.jks -alias kafka-client -import -file kafka.client.signed.crt
1

1.9 拷贝jks文件到其他集群服务器上

scp -r cert root@hadoop101:`pwd`
scp -r cert root@hadoop102:`pwd`
1
2

二、分别修改kafka配置文件server.properties

cp server.properties server-ssl.properties 
vim server-ssl.properties
1
2

listeners=PLAINTEXT://hadoop100:9092,SSL://hadoop100:9093

security.inter.broker.protocol=SSL
ssl.keystore.location=/opt/kafka_2.13-3.6.1/cert/server.keystore.jks
ssl.keystore.password=123456
ssl.key.password=123456
ssl.truststore.location=/opt/kafka_2.13-3.6.1/cert/server.trustkeystore.jks
ssl.truststore.password=123456
ssl.client.auth=required
1
2
3
4
5
6
7
8
9

启动kafka

 nohup /opt/kafka_2.13-3.6.1/bin/kafka-server-start.sh /opt/kafka_2.13-3.6.1/config/server-ssl.properties > /dev/null 2>&1 &
1

三、创建clientssl.properties

security.inter.broker.protocol=SSL
ssl.keystore.location=/opt/kafka_2.13-3.6.1/cert/server.keystore.jks
ssl.keystore.password=123456
ssl.key.password=123456
ssl.truststore.location=/opt/kafka_2.13-3.6.1/cert/server.trustkeystore.jks
ssl.truststore.password=123456
1
2
3
4
5
6