tls: bad record MAC about charts

[dicolasi]

The certificate is a self-signed one created by strimzi. Without insecureSkipTlsVerify: true kwol won't start since the certificate it is not signed by a trusted CA.
Here the error:

│ kowl {"level":"debug","ts":"2020-12-17T09:25:59.813Z","msg":"client/metadata got error from broker -1 while fetching metadata: x509: certificate signed by unknown authority","source":"sarama"}                                                                             │

[weeco]

I haven't seen that error yet. What TLS protocols are allowed on the server side? Maybe any helpful log messages on the server side?

Regarding insecureSkipTlsVerify this only means that the certificate will be checked for validity. If issued correctly and used with the right DNS you don't need to enable this for self signed certificates. You can configure which CAs you trust by passing a CA file into Kowl.

[dicolasi]

@weeco this is the log I got server side:

│ 2020-12-17 09:27:36,654 INFO [SocketServer brokerId=0] Failed authentication with /10.0.1.43 (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-0-ListenerName(INTERNAL-9093)-SSL-3]

[dicolasi]

I haven't seen that error yet. What TLS protocols are allowed on the server side? Maybe any helpful log messages on the server side?

Regarding insecureSkipTlsVerify this only means that the certificate will be checked for validity. If issued correctly and used with the right DNS you don't need to enable this for self signed certificates. You can configure which CAs you trust by passing a CA file into Kowl.

I am using an internal listener, not an exposed one.

    listeners:                                                                                                                                                                                                                                                               │
│     - authentication:                                                                                                                                                                                                                                                        │
│         type: tls                                                                                                                                                                                                                                                            │
│       name: internal                                                                                                                                                                                                                                                         │
│       port: 9093                                                                                                                                                                                                                                                             │
│       tls: true                                                                                                                                                                                                                                                              │
│       type: internal

[dicolasi]

@weeco this is what is allowed server side:

https://strimzi.io/docs/0.8.1/#type-KafkaListenerAuthenticationScramSha512-reference

[weeco]

@dicolasi That shouldn't matter. I'd recommend you take a look at your certificates again and see what SANs are configured. There are multiple ways to connect internally to your cluster. (e. g. kafka:9093 or kafka.namespace.svc.cluster.local:9093, ...)

Above Kafka server error message seem to indicate that endpoint identification is required which does not work. I hope that gives you something to research for. I'm not very familar with Strimzi and I won't be able to assist with that issue, sorry.

[dicolasi]

@weeco I am already connected properly:

kafka:
      brokers:
        - kafka-prod-kafka-bootstrap.kafka.svc:9093
        

Thanks anyway :)

[weeco]

@dicolasi The DNS is probably used to verify the SSL certificate though. Hence I mentioned that your specific DNS might not be one of the SANs in your TLS certificates