Configure TLS/SSL encryption for Kafka brokers

Kafka supports TLS/SSL encrypted communication with both brokers and clients. To enable and configure TLS/SSL, you need to enable TLS/SSL for the brokers and enter key and truststore related information.

The following list of steps walks you through the configuration required to set up TLS/SSL encryption for Kafka brokers. It lists all mandatory configuration properties as well as a number of optional properties that you can configure.

Kafka brokers support multiple key and truststore types. The following instructions, however, do not provide details regarding how the key or truststore type used by the brokers is configured. This is because the store type is not configured at a broker level. Instead, it is configured on Cloudera Manager’s central security page by going to Administration > Settings > Java Keystore Type.

Generate or acquire a key and truststore for your brokers which contain all necessary keys and certificates.
Note down the locations and passwords for the key and truststores. You will need to provide these during configuration.

In Cloudera Manager, select the Kafka service.
Go to Configuration.

Find and configure the following properties based on your cluster and requirements.


Cloudera Manager Property	Description
Enable TLS/SSL for Kafka Broker	Enables or disables TLS/SSL communication between clients and the Kafka broker.
Kafka Broker TLS/SSL Server JKS Keystore File Location	The path to the TLS/SSL keystore file containing the server certificate and private key used for TLS/SSL. Used when the Kafka broker is acting as a TLS/SSL server.
Kafka Broker TLS/SSL Server JKS Keystore File Password	The password for the Kafka broker keystore file.
Kafka Broker TLS/SSL Server JKS Keystore Key Password	The password that protects the private key contained in the keystore used when the Kafka broker is acting as a TLS/SSL server.
Kafka Broker TLS/SSL Client Trust Store File	The location on disk of the truststore used to confirm the authenticity of TLS/SSL servers that the Kafka broker might connect to. This is used when the Kafka broker is the client in a TLS/SSL connection. This truststore must contain the certificate(s) that signed the certificate(s) of the connected service(s). If this parameter is not provided, the default list of known certificate authorities is used instead.
Kafka Broker TLS/SSL Client Trust Store Password	The password for the Kafka broker truststore file. This password is not mandatory to access the truststore; this field can be left blank. This password provides optional integrity checking of the file. The contents of truststores are certificates, and certificates are public information.
Supported SSL/TLS versions for Kafka Broker	Lists the TLS protocol versions enabled on Kafka broker listeners, metrics, and JMX ports. Defaults to the centralized Cloudera Manager TLS settings. Visible when the `TLS_ADVANCED_CONTROL` feature flag is enabled. Set this to match your security policy, for example, `TLSv1.3` or `TLSv1.2,TLSv1.3`. Do not use TLS 1.0 or TLS 1.1.
TLS Cipher List for Kafka Broker	Lists the cipher suites the Kafka broker accepts. Defaults to the centralized Cloudera Manager cipher list. Visible when the `TLS_ADVANCED_CONTROL` feature flag is enabled.

(Optional) Configure additional properties.

When TLS_ADVANCED_CONTROL is enabled, Supported SSL/TLS versions and TLS Cipher List appear as first-class Cloudera Manager properties for protocols and ciphers. Safety valve settings for ssl.enabled.protocols and ssl.cipher.suites take precedence over other Cloudera Manager configuration, including these properties. Cloudera recommends using the Cloudera Manager properties when the flag is enabled because they are integrated into Cloudera Manager (typed configuration with predefined values), which makes them safer to use. For other TLS/SSL settings, or when the flag is disabled, use the Kafka Broker Advanced Configuration Snippet (Safety Valve) for kafka.properties property. The following are some of the most commonly used optional properties:


Kafka Broker Property	Description
ssl.provider	The name of the security provider used for TLS/SSL connections. Default is the default security provider of the JVM.
ssl.cipher.suites	A cipher suite is a named combination of authentication, encryption, MAC, and a key exchange algorithm used to negotiate the security settings for a network connection using the TLS/SSL network protocol.
ssl.enabled.protocols	List of enabled protocols. Set this to match your security policy, for example, `TLSv1.3` or `TLSv1.2,TLSv1.3`. Do not use TLS 1.0 or TLS 1.1.

Click Save Changes.
Restart the Kafka service.

Kafka brokers are configured for TLS/SSL encryption.

Configure your clients for TLS/SSL encryption. Alternatively, you can also continue with configuring TLS/SSL authentication for the brokers.