Starting zookeeper

————————
kafka/bin/zookeeper-server-start.sh -daemon kafka/config/zookeeper.properties

tail -n 100 kafka/logs/zookeeper.out

echo "ruok" |nc localhost 2181 ;echo

To start Kafka
———————
kafka/bin/kafka-server-start.sh -daemon kafka/config/server.propertie

tail -n 10 kafka/logs/kafkaServer.out

To stop Kafka and zookeeper

———————————————————-
kafka/bin/kafka-server-stop.sh
kafka/bin/zookeeper-server-stop.sh

Change/add the following properties in server.properties

————————————————————————————————————————
Advertised.listeners=PLAINTEXT://localhost:9092
Zookeeper.connect=localhost:2181

Settingup in the Kafka client

————————————————

kafka/bin/kafka-topics.sh -zookeeper localhost:2181 --create --topic

kafka-security-topic --replication-factor 1 --partitions 2

To start Kafka producer and consumer

—————————————————

kafka/bin/kafka-console-producer.sh --broker-list localhost:9092

--topic kafka-security-topic

kafka/bin/kafka-console-consumer.sh --bootstrap-server
localhost:9092 --topic kafka-security-topic

Creating Certificate Authority(CA)

—————————————————

openssl req -new -newkey rsa:4906 -days 365 -x509 -subj

"/CN=Kafka-Security-CA" -keyout ca-key -out ca-cert -nodes
this will generate private key ‘ca-key’ and public certificate ‘ca-cert
file’

Setting up SSL in Kafka

————————————

export SRVPASS=serversecret

Generate Kafka broker certificate using key tool command

keytool -genkey -keystore kafka.server.keystore.jks -validity 365

-storepass $SRVPASS -keypass $SRVPASS -dname "CN=localhost"
-storetype pkcs12

keytool -list -v -keystore kafka.server.keystore.jks

To get signed version of certificate for Kafka broker( 2 way process)

keytool -keystore kafka.server.keystore.jks -certreq -file cert-file

-storepass $SRVPASS -keypass $SRVPASS

To sign certificate

openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-
signed -days 365 -CAcreateserial -passin pass:$SRVPASS

keytool -printcert -v -file cert-signed

To create trust store on Kafka broker

——————————————

keytool -keystore kafka.server.truststore.jks -alias CARoot -import

-file ca-cert -storepass $SRVPASS -keypass $SRVPASS -noprompt

To import signed certificate into keystore

—————————————————————

keytool -keystore kafka.server.keystore.jks -alias CARoot -import -file

ca-cert -storepass $SRVPASS -keypass $SRVPASS -noprompt

-keystore kafka.server.keystore.jks -import -file cert-signed

-storepass $SRVPASS -keypass $SRVPASS -noprompt

Configure Kafka broker

——————————

/config/server.properties

listeners=PLAINTEXT://localhost:9092,SSL://localhost:9093
advertised.listeners=PLAINTEXT://localhost:9092,SSL://localhost:9093
zookeeper.connect=localhost:2181

ssl.keystore.location=/Users/nmalla/naidu/softwares/sslcrerts/kafka.server.
keystore.jks
ssl.keystore.password=serversecret
ssl.key.password=serversecret
ssl.truststore.location=/Users/nmalla/naidu/softwares/sslcrerts/kafka.serve
r.truststore.jks
ssl.truststore.password=serversecret

Restart Kafka

grep "EndPoint" kafka/logs/server.log

———
Confluent blog

# With user prompts

keytool -keystore kafka.server.keystore.jks -alias localhost -genkey

# Without user prompts, pass command line arguments

keytool -keystore kafka.server.keystore.jks -alias localhost -validity
365 -genkey -storepass password -keypass password -dname
{distinguished-name} -ext SAN=DNS:{hostname}