<p>I have configured a Kafka cluster on Kubernetes using Strimzi. Using this article - <a href="https://itnext.io/kafka-on-kubernetes-the-strimzi-way-part-2-43192f1dd831" rel="nofollow noreferrer">https://itnext.io/kafka-on-kubernetes-the-strimzi-way-part-2-43192f1dd831</a>
But the security service in my company does not want to deploy this solution in UAT with a self-signed certificate.
Could you please tell me can I import our trust certificate from a trusted surf center into this Kafka solution.</p>
<p>I add this section in my yml file  refer <a href="https://strimzi.io/docs/operators/master/using.html#kafka-listener-certificates-str" rel="nofollow noreferrer">https://strimzi.io/docs/operators/master/using.html#kafka-listener-certificates-str</a>
configuration:
brokerCertChainAndKey:
secretName: es-kafka-secret
certificate: certificate.crt
key: certificate.key</p>
<p>But when I test I had error</p>
<pre><code>
[thrd:ssl://104.42.195.73:9094/bootstrap]: ssl://104.42.195.73:9094/bootstrap: SSL handshake failed: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed: broker certificate could not be verified, verify that ssl.ca.location is correctly configured or root CA certificates are installed (install ca-certificates package) (after 377ms in state CONNECT)
panic: interface conversion: kafka.Event is kafka.Error, not *kafka.Message

goroutine 38 [running]:
main.main.func2(0xc421004060)
        /root/kafka-kubernetes-strimzi/part-3/go-client-app/kafka-tls-auth-client.go:85 +0x2a5
created by main.main
        /root/kafka-kubernetes-strimzi/part-3/go-client-app/kafka-tls-auth-client.go:74 +0x109

</code></pre>
<p>And how after adding my certificate I can check the connection?</p>
<p>Could you please help me? Thanks.</p>

Vitalii Fedorenko
<p>As described in the Strimzi documentation - you have two options to choose from:</p>
<ol>
<li>You can provide your own CA for the cluster or clients certification authorities. For more details see <a href="https://strimzi.io/docs/operators/latest/full/using.html#installing-your-own-ca-certificates-str" rel="nofollow noreferrer">https://strimzi.io/docs/operators/latest/full/using.html#installing-your-own-ca-certificates-str</a></li>
<li>You can let Strimzi use its self-signed CA for ZooKeeper, Kafka replication etc. and just configure your own server certificate for the Kafka listeners where clients will be connecting. For more details see <a href="https://strimzi.io/docs/operators/latest/full/using.html#kafka-listener-certificates-str" rel="nofollow noreferrer">https://strimzi.io/docs/operators/latest/full/using.html#kafka-listener-certificates-str</a></li>
</ol>
<p>Once you configure it, you can check whether it was correctly applied for example using OpenSSL (<code>openssl s_client ...</code>). Or you can use the Java clients and set the Java system property <code>javax.net.debug</code> to value <code>ssl</code> - that would also print the details about the TLS handshake, the used certificates etc.</p>
