<p>I am trying to set up using my GoDaddy certificate as a listener for Kafka. Using this article <a href="https://strimzi.io/docs/operators/in-development/using.html#kafka-listener-certificates-str" rel="nofollow noreferrer">https://strimzi.io/docs/operators/in-development/using.html#kafka-listener-certificates-str</a>.</p>
<pre><code>apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: es-kafka-cluster
spec:
  kafka:
    version: 2.7.0
    replicas: 2
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
      - name: external
        port: 9094
        type: loadbalancer
        tls: true
        authentication:
          type: tls
        configuration:  
          brokerCertChainAndKey:
            secretName: es-tls-certificate
            certificate: certificate.crt
            key: certificate.key
    authorization:
      type: simple
    config:
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      log.message.format.version: &quot;2.7&quot;
    storage:
      type: ephemeral
  zookeeper:
    replicas: 2
    storage:
      type: ephemeral
  entityOperator:
    userOperator: {}
    topicOperator: {}
</code></pre>
<p>I am sending a check for a certificate openssl s_client -connect MY_IP:9094 -servername MY_IP</p>
<p>Returns my correct certificate.
But when I try to execute the command I get an error</p>
<pre><code> kafkacat -C -b MY_IP:9094 -X security.protocol=ssl -t schedules
% ERROR: Failed to query metadata for topic schedules: Local: Timed out

</code></pre>
<p>Log from Kafka</p>
<pre><code>(SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-0-ListenerName(EXTERNAL-9094)-SSL-12
</code></pre>

Vitalii Fedorenko
<pre><code>    authentication:
      type: tls
</code></pre>
<p>Authentication TLS seems to state your client need to authenticate with mtls, try the following command and post and update please</p>
<p>kafkacat -b MY_IP:9094 <br />
-X security.protocol=SSL -X ssl.key.location=private_key.pem -X ssl.key.password=my_key_password <br />
-X ssl.certificate.location=signed_cert.pem.txt <br />
-X ssl.ca.location=ca_cert.pem -L</p>
<p>Or remove the authentication clause</p>
<p>And add to kafkacat</p>
<p>-X ssl.ca.location=ca_cert.pem</p>
