# Metricbeat - SSL Kafka Output (Failed authentication)

**URL:** <https://discuss.elastic.co/t/metricbeat-ssl-kafka-output-failed-authentication/267261>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [March 15, 2021, 12:32pm UTC](https://discuss.elastic.co/t/metricbeat-ssl-kafka-output-failed-authentication/267261 "2021-03-15T12:32:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marti1](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@marti1](https://discuss.elastic.co/u/marti1)\
**Post date:** [March 15, 2021, 12:32pm UTC](https://discuss.elastic.co/t/metricbeat-ssl-kafka-output-failed-authentication/267261/1 "2021-03-15T12:32:32Z")

</div>

Hi,  
I'm trying to configure a secure connection (SSL) between my beat (metricbeat windows) and kafka server, but the handshake is failing.

Is my configuration `metricbeat.yml` OK?

```auto
output.kafka:

  # Active
  enabled: true

  # The Kafka hosts
  hosts: ["<serverName>:9093"]

  # Topics
  topic: 'windowstest'

  # SSL
  # Kafka main certificate (ca)
  ssl.certificate_authorities: ["<path>/ca_cert.pem"]

  # Beat certificate that was certificated by kafka main certificate
  ssl.certificate: "<path>/beat_cert.pem"

  # Beat certificate Key
  ssl.key: "<path>/beat_cert.key"

  # Client Certificate Passphrase
  #ssl.key_passphrase: "passwd"

```

The configuration properties in my kafka server are the following ones:

File `server.properties` :

```auto
# Listeners with SSL
listeners=PLAINTEXT://<serverName>:9092,SSL://<serverName>:9093

# SSL
ssl.truststore.location=/etc/pki/tls/kafka.server.truststore.jks
ssl.truststore.password=passwd
ssl.keystore.location=/etc/pki/tls/kafka.server.keystore.jks
ssl.keystore.password=passwd
ssl.password=passwd

ssl.client.auth=required
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1

```

File `consumer.properties` :

```auto
# SSL
security.protocol=SSL
ssl.truststore.location=/etc/pki/tls/kafka.client.truststore.jks
ssl.truststore.password=passwd
ssl.keystore.location=/etc/pki/tls/kafka.client.keystore.jks
ssl.keystore.password=passwd
ssl.password=passwd

```

File `producer.properties` :

```auto
# SSL
security.protocol=SSL
ssl.truststore.location=/etc/pki/tls/kafka.client.truststore.jks
ssl.truststore.password=passwd
ssl.keystore.location=/etc/pki/tls/kafka.client.keystore.jks
ssl.keystore.password=passwd
ssl.password=passwd

```

If it helps, this is the response of my server (`openssl s_client -debug -connect <serverName>:9093 -tls1`):

```auto
New, TLSv1.0, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol : TLSv1
    Cipher : ECDHE-RSA-AES256-SHA
    Session-ID: <id>
    Session-ID-ctx:
    Master-Key: <id>
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1615812929
    Timeout : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
    Extended master secret: yes

```

I have been trying different configurations, but no ones worked. Any idea how can I solve it?

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2021, 12:32pm UTC](https://discuss.elastic.co/t/metricbeat-ssl-kafka-output-failed-authentication/267261/2 "2021-04-12T12:32:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.