Skip to content

feat(kafka): enabling tls connection without client authentication #3580

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

brunodomenici
Copy link

Kafka TLS

As we can see in #1277 , we can't enable TLS without setting insecureSkipVerify to true or setting client authentication.

I propose a TLS.Enable with default to false (to keep compatibility with existing configurations). With that, we can set only this to true to activate TLS without needing to set other configuration in this object.

Checklist:

@brunodomenici brunodomenici requested a review from whynowy as a code owner May 2, 2025 15:58
@whynowy
Copy link
Member

whynowy commented May 9, 2025

Thanks @brunodomenici .

What is the difference between this new property and insecureSkipVerify?

@brunodomenici
Copy link
Author

Hello @whynowy
You're welcome.
If we set insecureSkipVerify = true we are not validating broker's certificate. This is a security issue for using this in my company.

@shearn89
Copy link
Contributor

shearn89 commented Jul 8, 2025

To add a use case here - we deploy AWS MSK, which defaults to security.protocol=SSL for comms even when the cluster requires no auth. We have to currently set insecureSkipVerify = true to connect at all, even though we're not using mTLS. It would be great to be able to use TLS to the broker (but not mTLS), which (if I understand correctly) this PR allows us to do.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants