title: Configuring Kafka Client One Way SSL with PEM
body: <p>I am trying to configure one way SSL for my kafka client using PEM. For now I'm experimenting with <code>kafka-topics.sh --list</code> but in the future it will be a Java client that cannot use JKS. The error message is telling me to specify the type, but the docs I'm referencing don't tell me how: <a href="https://kafka.apache.org/documentation/#producerconfigs_ssl.truststore.certificates" rel="nofollow noreferrer">https://kafka.apache.org/documentation/#producerconfigs_ssl.truststore.certificates</a></p>
  <blockquote>
  <p>ssl.truststore.certificates</p>
  <p>Trusted certificates in the format specified by 'ssl.truststore.type'. Default SSL engine factory supports only PEM format with X.509 certificates.</p>
  <p>Type: password
  Default:  null
  Valid Values:
  Importance:   high</p>
  </blockquote>
  <p>Below is the error message from kafka-topics.sh</p>
  <pre><code>~/kafka/bin/kafka-topics.sh \
    --command-config /home/kafka/kafka/client_security_one_way_ssl_using_pem.properties \
    --bootstrap-server MY_IP:9093 \
    --list
  Exception in thread &quot;main&quot; org.apache.kafka.common.KafkaException: Failed to create new KafkaAdminClient
          at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:535)
          at org.apache.kafka.clients.admin.Admin.create(Admin.java:65)
          at kafka.admin.TopicCommand$AdminClientTopicService$.createAdminClient(TopicCommand.scala:228)
          at kafka.admin.TopicCommand$AdminClientTopicService$.apply(TopicCommand.scala:232)
          at kafka.admin.TopicCommand$.main(TopicCommand.scala:59)
          at kafka.admin.TopicCommand.main(TopicCommand.scala)
  Caused by: org.apache.kafka.common.errors.InvalidConfigurationException: SSL trust store certs can be specified only for PEM, but trust store type is JKS.
  </code></pre>
  <p>Contents of <code>client_security_one_way_ssl_using_pem.properties</code>:</p>
  <pre><code>ssl.endpoint.identification.algorithm=
  security.protocol=SSL
  
  ssl.truststore.certificates=-----BEGIN CERTIFICATE----- \
  &lt; SECRET :) &gt; \
  -----END CERTIFICATE-----
  </code></pre>
  <p>I also tried adding</p>
  <pre><code>ssl.truststore.type=PEM
  </code></pre>
  <p>but now my error message is:</p>
  <pre><code>[2021-03-10 16:18:21,343] WARN The configuration 'ssl.truststore.certificates' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig)
  [2021-03-10 16:18:21,344] WARN The configuration 'ssl.truststore.type' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig)
  [2021-03-10 16:18:21,344] WARN The configuration 'ssl.endpoint.identification.algorithm' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig)
  </code></pre>
  <p>These properties should be supported in 2.7.0:</p>
  <pre><code>~/kafka/bin/kafka-topics.sh   --version
  2.7.0 (Commit:448719dc99a19793)
  </code></pre>