Using Vault for securing Kafka communication

[Eugene Dvorkin]

I want to secure Kafka messaging system using Volt. Kafka servers, as being java application, requires following properties:

ssl.client.auth=required

ssl.keystore.location=/var/private/ssl/kafka.server.keystore.jks

ssl.keystore.password=test1234

ssl.key.password=test1234

ssl.truststore.location=/var/private/ssl/kafka.server.truststore.jks

ssl.truststore.password=test1234

keystore for private signed certificate and keys and truststore for public ones. 

I am using Vault PKI module to store certificates and for CA.

I was following this blog http://cuddletech.com/?p=959 and was able to generate certificate and the private key.

Now, what is the relationship between Vault and java's keystore and truststores?

Will it be correct to import final signed certificate and the private key into keystore file and root certificate into truststore using keytool?

Is there any resources I can look to learn how to map Vault functionality into java world? Anybody did integration with Kafka?

here what need to be done according to Kafka docs using keytools and openssl:

#!/bin/bash
PASSWORD=test1234
VALIDITY=365
keytool -keystore kafka.server.keystore.jks -alias localhost -validity $VALIDITY -genkey
openssl req -new -x509 -keyout ca-key -out ca-cert -days $VALIDITY
keytool -keystore kafka.server.truststore.jks -alias CARoot -import -file ca-cert
keytool -keystore kafka.client.truststore.jks -alias CARoot -import -file ca-cert
keytool -keystore kafka.server.keystore.jks -alias localhost -certreq -file cert-file
openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-signed -days $VALIDITY -CAcreateserial -passin pass:$PASSWORD
keytool -keystore kafka.server.keystore.jks -alias CARoot -import -file ca-cert
keytool -keystore kafka.server.keystore.jks -alias localhost -import -file cert-signed
keytool -keystore kafka.client.keystore.jks -alias localhost -validity $VALIDITY -genkey
keytool -keystore kafka.client.keystore.jks -alias localhost -certreq -file cert-file
openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-signed -days $VALIDITY -CAcreateserial -passin pass:$PASSWORD
keytool -keystore kafka.client.keystore.jks -alias CARoot -import -file ca-cert
keytool -keystore kafka.client.keystore.jks -alias localhost -import -file cert-signed

from

https://www.confluent.io/blog/apache-kafka-security-authorization-authentication-encryption/

Thanks

  

[Tatyana Arenburg]

Hi Eugene,

Did you figure it out?

I'm struggling with the same question of how to integrate Vault and Kafka, and until that point found just that i have to create the jks files 

(https://github.com/steve-perkins/kafka-tls-demo) 

Can you please share how did you set this?

Thanks in advance.

[Jeff Mitchell]

Hi Tatyana,

Vault doesn't natively generate keystore files, but in the next
release the PKI backend will be able to return private keys marshaled
as PKCS#8, which I hear is a useful thing for Java.

Best,
Jeff

> --
> This mailing list is governed under the HashiCorp Community Guidelines -
> https://www.hashicorp.com/community-guidelines.html. Behavior in violation
> of those guidelines may result in your removal from this mailing list.
>
> GitHub Issues: https://github.com/hashicorp/vault/issues
> IRC: #vault-tool on Freenode
> ---
> You received this message because you are subscribed to the Google Groups
> "Vault" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to vault-tool+...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/vault-tool/73d7b3ee-5927-4299-8f18-efabf7436952%40googlegroups.com.
>
> For more options, visit https://groups.google.com/d/optout.