title: Kafka won't start with PEM certificate
body: <p>I found that Kafka 2.7.0 supports PEM certificates and I decided to try setting up the broker with DigiCert SSL certificate. I used new options and I did everything like in example in <a href="https://cwiki.apache.org/confluence/display/KAFKA/KIP-651+-+Support+PEM+format+for+SSL+certificates+and+private+key" rel="noreferrer">KIP-651</a>. But I get the error:</p>
  <pre><code>[2021-01-20 17:54:55,787] ERROR [KafkaServer id=0] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
  org.apache.kafka.common.config.ConfigException: Invalid value javax.net.ssl.SSLHandshakeException: no cipher suites in common for configuration A client SSLEngine created with the provided settings can't connect to a server SSLEngine created with those settings.
          at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.java:98)
          at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChannelBuilder.java:72)
          at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:157)
          at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:97)
          at kafka.network.Processor.&lt;init&gt;(SocketServer.scala:790)
          at kafka.network.SocketServer.newProcessor(SocketServer.scala:415)
          at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:288)
          at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:287)
          at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:254)
          at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:251)
          at scala.collection.IterableOnceOps.foreach(IterableOnce.scala:553)
          at scala.collection.IterableOnceOps.foreach$(IterableOnce.scala:551)
          at scala.collection.AbstractIterable.foreach(Iterable.scala:920)
          at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:251)
          at kafka.network.SocketServer.startup(SocketServer.scala:125)
          at kafka.server.KafkaServer.startup(KafkaServer.scala:303)
          at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
          at kafka.Kafka$.main(Kafka.scala:82)
          at kafka.Kafka.main(Kafka.scala)
  </code></pre>
  <p><em>openssl x509 -in certificate.pem -text:</em></p>
  <pre><code>Certificate:
      ...
      Signature Algorithm: ecdsa-with-SHA384
          ...
          Subject Public Key Info:
              Public Key Algorithm: id-ecPublicKey
                  Public-Key: (256 bit)
  </code></pre>
  <p>I've tried using different versions of Oracle JDK and OpenJDK, but no effect.</p>
  <p>I also tried to set certificate with options:</p>
  <pre><code>ssl.keystore.type=PEM
  ssl.keystore.location=/opt/kafka/certs/certificate.pem
  ssl.key.password=null
  </code></pre>
  <p>And I got а new error:</p>
  <pre><code>[2021-01-23 20:33:21,552] ERROR [KafkaServer id=0] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
  org.apache.kafka.common.errors.InvalidConfigurationException: Failed to load PEM SSL keystore /opt/kafka/certs/certificate.pem
  Caused by: org.apache.kafka.common.errors.InvalidConfigurationException: Invalid PEM keystore configs
  Caused by: java.io.IOException: overrun, bytes = 111
      at javax.crypto.EncryptedPrivateKeyInfo.&lt;init&gt;(EncryptedPrivateKeyInfo.java:92)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$PemStore.privateKey(DefaultSslEngineFactory.java:512)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$PemStore.createKeyStoreFromPem(DefaultSslEngineFactory.java:462)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$PemStore.&lt;init&gt;(DefaultSslEngineFactory.java:435)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedPemStore.load(DefaultSslEngineFactory.java:412)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.&lt;init&gt;(DefaultSslEngineFactory.java:349)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedPemStore.&lt;init&gt;(DefaultSslEngineFactory.java:405)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.createKeystore(DefaultSslEngineFactory.java:293)
      at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.configure(DefaultSslEngineFactory.java:161)
      at org.apache.kafka.common.security.ssl.SslFactory.instantiateSslEngineFactory(SslFactory.java:136)
      at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.java:93)
      at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChannelBuilder.java:72)
      at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:157)
      at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:97)
      at kafka.network.Processor.&lt;init&gt;(SocketServer.scala:790)
      at kafka.network.SocketServer.newProcessor(SocketServer.scala:415)
      at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:288)
      at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:287)
      at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:254)
      at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:251)
      at scala.collection.IterableOnceOps.foreach(IterableOnce.scala:553)
      at scala.collection.IterableOnceOps.foreach$(IterableOnce.scala:551)
      at scala.collection.AbstractIterable.foreach(Iterable.scala:920)
      at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:251)
      at kafka.network.SocketServer.startup(SocketServer.scala:125)
      at kafka.server.KafkaServer.startup(KafkaServer.scala:303)
      at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
      at kafka.Kafka$.main(Kafka.scala:82)
      at kafka.Kafka.main(Kafka.scala)
  </code></pre>
  <p>But if convert this certificate to jks:</p>
  <pre><code>openssl pkcs12 -export -in certificate.pem -out certificate.p12
  keytool -importkeystore -srckeystore certificate.p12 -srcstoretype pkcs12 -destkeystore certificate.jks
  
  echo 'ssl.keystore.location=/opt/kafka/certs/certificate.jks' &gt;&gt;server.properties
  echo 'ssl.keystore.password=password' &gt;&gt;server.properties
  </code></pre>
  <p>Broker works correctly.</p>
  <p>Could this be a bug or am I doing anything wrong? Full log <a href="https://issues.apache.org/jira/secure/attachment/13019123/kafka.log" rel="noreferrer">here</a></p>