apache / apache/pulsar

TLS mutual Authentication with PEM configuration fails to establish a successful connection

Open
#19,943 1 comment 0 reactions 0 assignees View on GitHub
Stale type/bug
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Version

Java Client(2.10.2)-->broker(2.11.0)
Broker instance OS: Amazon Linux 2023
Java App running OS : Windows 10

### Minimal reproduce step

1. Configure the Pulsar instance to use TLS Authentication using PEM files.
Followed these steps exactly to set up mTLS on the broker.
https://pulsar.apache.org/docs/2.11.x/security-tls-authentication/#enable-mtls-authentication-on-brokers
The instance was successfully up without any errors or issues.

2. Then used this piece of code to create the PulsarClient object
`PulsarClient client = PulsarClient.builder()
.serviceUrl("pulsar+ssl://broker.example.com:6651/")
.tlsTrustCertsFilePath("/path/to/ca.cert.pem")
.authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
"tlsCertFile:/path/to/my-role.cert.pem,tlsKeyFile:/path/to/my-role.key-pk8.pem")
.build();`
3. The client creation may be successful but once I try to create a consumer or producer object using this client then I encounter this error.

> org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.ExecutionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException{"previous":[{"attempt":0,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":1,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":2,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":3,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":4,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":5,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":6,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":7,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":8,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"}]}{"previous":[{"attempt":0,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":1,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":2,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":3,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":4,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":5,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":6,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":7,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"},{"attempt":8,"error":"java.util.concurrent.CompletionException: org.apache.pulsar.client.api.PulsarClientException: java.util.concurrent.CompletionException: java.lang.NullPointerException"}]}

4. We have carried out various tests browsing through the issue list and tried the solutions mentioned in https://github.com/apache/pulsar/issues/5348 but were unsuccessful.

5. Also please let us know if the [issue](https://github.com/apache/pulsar/issues/5348) w.r.t certificate location if provided from a different drive location is resolved in latest version of the client.

### What did you expect to see?

We expect to successfully connect to the Pulsar instance.

### What did you see instead?

It fails to connect to it and the error message is not much of help.

### Anything else?

We observed that even if we use KeyStore type of configuration we observed that https://github.com/apache/pulsar/issues/5348 this issue persists where the SDK couldn't load the file if the file is located in a different drive other than C.

Request you to provide any inputs to resolve these issues.

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the Java client 2.10.2, broker 2.11.0, PEM-based mTLS configuration, and the Windows certificate paths described in the issue. Start with the client authentication configuration and the reported NullPointerException, then compare the PEM and KeyStore cases, including certificates on another drive. Done means a successful producer or consumer connection and an actionable error when certificate loading fails.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.