测试环境搭建整套大数据系统（十九：kafka ssl）

一：生成配置cert

1.1 生成server keystore

dart 复制代码

keytool -keystore server.keystore.jks -alias kafka-server -validity 365 -keyalg RSA -genkey

查看

dart 复制代码

 keytool -list -keystore server.keystore.jks -v

1.2生成client keystore

dart 复制代码

keytool -keystore client.keystore.jks -alias kafka-client -validity 365 -keyalg RSA -genkey

查看

dart 复制代码

keytool -list -keystore client.keystore.jks -v

1.3 生成CA证书

dart 复制代码

openssl req -new -x509 -keyout ca.key -out ca.crt -days 365

1.4 将 CA 证书导入到服务器和客户端的信任库中

dart 复制代码

 keytool -keystore server.trustkeystore.jks -alias CARoot -import -file ca.crt

dart 复制代码

keytool -keystore client.trustkeystore.jks -alias CARoot -import -file ca.crt

1.5 导出证书

dart 复制代码

keytool -keystore server.keystore.jks -alias kafka-server -certreq -file kafka.server.crt

dart 复制代码

keytool -keystore client.keystore.jks -alias kafka-client -certreq -file kafka.client.crt

1.6使用 CA 证书进行签名任务

dart 复制代码

openssl x509 -req -CA ca.crt -CAkey ca.key -in kafka.server.crt -out kafka.server.signed.crt -days 365 -CAcreateserial

dart 复制代码

openssl x509 -req -CA ca.crt -CAkey ca.key -in kafka.client.crt -out kafka.client.signed.crt -days 365 -CAcreateserial

1.7 将 CA 证书导入到服务器和客户端的密钥库中

dart 复制代码

keytool -keystore server.keystore.jks -alias CARoot -import -file ca.crt

dart 复制代码

keytool -keystore client.keystore.jks -alias CARoot -import -file ca.crt

1.8 在 CA 证书签名后，将证书导入到服务器和客户端的密钥库中

dart 复制代码

keytool -keystore server.keystore.jks -alias kafka-server -import -file kafka.server.signed.crt

dart 复制代码

keytool -keystore client.keystore.jks -alias kafka-client -import -file kafka.client.signed.crt

1.9 拷贝jks文件到其他集群服务器上

dart 复制代码

scp -r cert root@hadoop101:`pwd`
scp -r cert root@hadoop102:`pwd`

二、分别修改kafka配置文件server.properties

dart 复制代码

cp server.properties server-ssl.properties 
vim server-ssl.properties

dart 复制代码

listeners=PLAINTEXT://hadoop100:9092,SSL://hadoop100:9093

security.inter.broker.protocol=SSL
ssl.keystore.location=/opt/kafka_2.13-3.6.1/cert/server.keystore.jks
ssl.keystore.password=123456
ssl.key.password=123456
ssl.truststore.location=/opt/kafka_2.13-3.6.1/cert/server.trustkeystore.jks
ssl.truststore.password=123456
ssl.client.auth=required

启动kafka

dart 复制代码

 nohup /opt/kafka_2.13-3.6.1/bin/kafka-server-start.sh /opt/kafka_2.13-3.6.1/config/server-ssl.properties > /dev/null 2>&1 &

三、创建clientssl.properties

dart 复制代码

security.inter.broker.protocol=SSL
ssl.keystore.location=/opt/kafka_2.13-3.6.1/cert/server.keystore.jks
ssl.keystore.password=123456
ssl.key.password=123456
ssl.truststore.location=/opt/kafka_2.13-3.6.1/cert/server.trustkeystore.jks
ssl.truststore.password=123456