confluentinc / confluentinc/libserdes

Support for SSL for the connection to Schema Registry is needed

Open
#40 0 comments 15 reactions 0 assignees View on GitHub
Dominant language
C
Stars
12
Forks
62
PR merge metrics
No merged PRs in 30d

Description

Support for SSL certificates and keystores configuration options for the connection to Schema Registry is needed.

Currently, this is not possible to connect to Schema Registry, requiring client SSL certificate, with `libserdes`:
```
$ ./kafkacat -b $KAFKA_BROKER_HOST:$KAFKA_BROKER_PORT \
> -t my-topic \
> -s value=avro \
> -r https://$KAFKA_API_KEY:$KAFKA_API_SECRET@$KAFKA_SCHEMA_REGISTRY_HOST:$KAFKA_SCHEMA_REGISTRY_PORT \
> -X security.protocol=SASL_SSL \
> -X sasl.mechanisms=PLAIN \
> -X sasl.username="$KAFKA_API_KEY" -X sasl.password="$KAFKA_API_SECRET" \
> -X ssl.keystore.location=$KAFKA_KEYSTORE_P12_LOCATION \
> -X ssl.keystore.password=$KAFKA_KEYSTORE_PASSPHRASE \
> -X ssl.key.password=$KAFKA_KEY_PASSPHRASE \
> -X enable.ssl.certificate.verification=false \
> -o beginning -C
% ERROR: Failed to format message in my-topic [0] at offset 2: Avro/Schema-registry message deserialization: REST request failed (code -1): HTTP request failed: SSL connect error : terminating
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the libserdes Schema Registry REST connection code and its existing configuration options. Use the kafkacat command and SSL keystore settings in the report as the reproduction case; done means a client certificate and keystore can be configured for a successful Schema Registry connection.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
api, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.