<p>I am trying to configure Strimzi Kafka listener custom cert, following the documentation: <a href="https://strimzi.io/docs/operators/latest/full/configuring.html#ref-alternative-subjects-certs-for-listeners-str" rel="nofollow noreferrer">https://strimzi.io/docs/operators/latest/full/configuring.html#ref-alternative-subjects-certs-for-listeners-str</a>
I want to expose those listener outside of the Azure Kubernetes Service within the private virtual network.</p>
<p>I have provided a custom cert with private key generated by an internal CA and pointed towards that secret in the Kafka configuration:</p>
<p><code>kubectl create secret generic kafka-tls --from-literal=listener.cer=$cert --from-literal=listener.key=$skey -n kafka</code></p>
<p>`</p>
<pre><code>listeners:
      - name: external
        port: 9094
        type: loadbalancer
        tls: true
        authentication:
          type: tls   
        #Listener TLS config     
        configuration:
          brokerCertChainAndKey: 
            secretName: kafka-tls
            certificate: listener.cer
            key: listener.key
          bootstrap:
            loadBalancerIP: 10.67.249.253
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;
          brokers:
          - broker: 0
            loadBalancerIP: 10.67.249.251
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;
          - broker: 1
            loadBalancerIP: 10.67.249.252
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;
          - broker: 2
            loadBalancerIP: 10.67.249.250
            annotations:
              service.beta.kubernetes.io/azure-load-balancer-internal: &quot;true&quot;
    authorization:
      type: simple

</code></pre>
<p>`</p>
<p>Certificate has following records:</p>
<p>SAN:
*.kafka-datalake-prod-kafka-brokers *.kafka-datalake-prod-kafka-brokers.kafka.svc kafka-datalake-prod-kafka-bootstrap kafka-datalake-prod-kafka-bootstrap.kafka.svc kafka-datalake-prod-kafka-external-bootstrap kafka-datalake-prod-kafka-external-bootstrap.kafka.svc kafka-datalake-prod-azure.custom.domain</p>
<p>CN=kafka-datalake-produkty-prod-azure.custom.domain</p>
<p>I have also created an A record in the custom DNS for the given address: kafka-datalake-produkty-prod-azure.custom.domain 10.67.249.253</p>
<p>Then, I created a KafkaUser object:</p>
<pre><code>apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: customuser
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka-datalake-prod
spec:
  authentication:
    type: tls
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: notify.somecustomapp.prod.topic_name 
          patternType: literal
        operations:
          - Create
          - Describe
          - Write
        # host: &quot;*&quot;

</code></pre>
<p>When I then retrieve the secrets from the Kafka cluster on AKS:</p>
<p><code>kubectl get secret kafka-datalake-prod-cluster-ca-cert -n kafka -o jsonpath='{.data.ca\.crt}' | base64 -d &gt; broker.crt kubectl get secret customuser -n kafka -o jsonpath='{.data.user\.key}' | base64 -d &gt; customuser.key kubectl get secret customuser  -n kafka -o jsonpath='{.data.user\.crt}' | base64 -d &gt; customuser.crt</code></p>
<p>Communication fails, when I try to connect and send some messages with a producer using those 3 files to authenticate/authorize, I get a following issue:</p>
<p><code>INFO:kafka.conn:&lt;BrokerConnection node_id=bootstrap-0 host=10.67.249.253:9094 &lt;connecting&gt; [IPv4 ('10.67.249.253', 9094)]&gt;: connecting to 10.67.249.253:9094 [('10.67.249.253', 9094) IPv4] INFO:kafka.conn:Probing node bootstrap-0 broker version INFO:kafka.conn:&lt;BrokerConnection node_id=bootstrap-0 host=10.67.249.253:9094 &lt;handshake&gt; [IPv4 ('10.67.249.253', 9094)]&gt;: Loading SSL CA from certs/prod/broker.crt INFO:kafka.conn:&lt;BrokerConnection node_id=bootstrap-0 host=10.67.249.253:9094 &lt;handshake&gt; [IPv4 ('10.67.249.253', 9094)]&gt;: Loading SSL Cert from certs/prod/customuser.crt INFO:kafka.conn:&lt;BrokerConnection node_id=bootstrap-0 host=10.67.249.253:9094 &lt;handshake&gt; [IPv4 ('10.67.249.253', 9094)]&gt;: Loading SSL Key from certs/prod/customuser.key [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)</code></p>
<p>What am I doing wrong?</p>
<p>The communication worked perfectly fine when I was using the same method of connecting, yet the cluster itself and listeners were using the default certs generated by Strimzi cluster.</p>
<p>All the best,
Krzysztof</p>

<p>@Turing85 @Jakub</p>
<p>Many thanks for your comments - especially those critical ones</p>
<p>And thanks, Jakub, for pointing me towards using the CA of custom certificate. What needed to be done in order to fix this was:</p>
<ol>
<li>switch the value obtained from kafka-datalake-prod-cluster-ca-cert secret with the full chain of root CA, intermediate signing cert and the certificate itself.</li>
<li>Add LoadBalancer IPs of brokers - this is stated in the documentation, yet the way it is formulated misguided me into thinking that adding hostnames/service names to SAN is enough (<a href="https://strimzi.io/docs/operators/latest/full/configuring.html#tls_listener_san_examples" rel="nofollow noreferrer">https://strimzi.io/docs/operators/latest/full/configuring.html#tls_listener_san_examples</a>, and later <a href="https://strimzi.io/docs/operators/latest/full/configuring.html#external_listener_san_examples" rel="nofollow noreferrer">https://strimzi.io/docs/operators/latest/full/configuring.html#external_listener_san_examples</a>).</li>
</ol>
<p>After those changes, everything started to work.</p>
<p>Thank you for help.</p>
