Subject Alternetive name not present even disable host name verification.

[deadmandrive]

I follow this guide to create kafka cluster with ssl link

I create certs and truststore using this script
I create kafka-ui docker compose as follow.

version: '2'
services:

  kafka-ui:
    container_name: kafka-ui
    image: provectuslabs/kafka-ui:latest
    network_mode: host
    environment:
      SERVER_PORT: 8081
      KAFKA_CLUSTERS_0_NAME: dev-uat
      KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SSL
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: 192.168.4.171:29092
      KAFKA_CLUSTERS_0_ZOOKEEPER: 192.168.4.171:2181,192.168.4.172:2181,192.168.4.173:2181
      KAFKA_CLUSTERS_0_SCHEMAREGISTRY: http://192.168.4.174:8081,http://192.168.4.175:8081
      KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION: /kafka.broker1.truststore.jks
      KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD: confluent
    volumes:
      - /root/kafka-cluster/ssl/broker01/kafka.broker1.truststore.jks:/kafka.broker1.truststore.jks

Kafka Cluster run up fine. But when i try to deploy provectus kafka ui I got this error.

INFO  [kafka-admin-client-thread | adminclient-1] o.a.k.c.n.Selector: [AdminClient clientId=adminclient-1] Failed authentication with /192.168.4.171 (SSL handshake failed)
2022-08-26 07:27:53,298 ERROR [kafka-admin-client-thread | adminclient-1] o.a.k.c.NetworkClient: [AdminClient clientId=adminclient-1] Connection to node -1 (/192.168.4.171:29092) failed authentication due to: SSL handshake failed
2022-08-26 07:27:53,298 WARN  [kafka-admin-client-thread | adminclient-1] o.a.k.c.a.i.AdminMetadataManager: [AdminClient clientId=adminclient-1] Metadata update failed due to authentication error
org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative names present
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:325)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:268)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:263)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
        at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:445)
        at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260)
        at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1247)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
        at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1192)
        at org.apache.kafka.common.network.SslTransportLayer.runDelegatedTasks(SslTransportLayer.java:430)
        at org.apache.kafka.common.network.SslTransportLayer.handshakeUnwrap(SslTransportLayer.java:514)
        at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:368)
        at org.apache.kafka.common.network.SslTransportLayer.handshake(SslTransportLayer.java:291)
        at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:178)
        at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:543)
        at org.apache.kafka.common.network.Selector.poll(Selector.java:481)
        at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:561)
        at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.processRequests(KafkaAdminClient.java:1333)
        at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1264)
        at java.base/java.lang.Thread.run(Thread.java:830)
Caused by: java.security.cert.CertificateException: No subject alternative names present
        at java.base/sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:142)
        at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:101)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:452)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:426)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:292)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)

This is config in kafka container as you can see ssl.endpoint.identification.algorithm= is set.

ssl.keystore.filename=kafka.broker1.keystore.jks
ssl.key.credentials=broker1_sslkey_creds
security.inter.broker.protocol=SSL
ssl.key.password=confluent
ssl.truststore.password=confluent
advertised.listeners=SSL://192.168.4.171:29092
ssl.truststore.filename=kafka.broker1.truststore.jks
ssl.truststore.credentials=broker1_truststore_creds
broker.id=1
ssl.keystore.password=confluent
listeners=SSL://0.0.0.0:29092
ssl.keystore.location=/etc/kafka/secrets/kafka.broker1.keystore.jks
zookeeper.connect=192.168.4.171:2181,192.168.4.172:2181,192.168.4.173:2181
ssl.truststore.location=/etc/kafka/secrets/kafka.broker1.truststore.jks
ssl.endpoint.identification.algorithm=
log.dirs=/var/lib/kafka/data
ssl.client.auth=requested
ssl.keystore.credentials=broker1_keystore_creds

My question is if I disable host name verification. It shouldn't error on this issue right?
Or I need to create certs and keystore with SAN?

[github-actions[bot]]

Hello there deadmandrive! 👋

Thank you and congratulations 🎉 for opening your very first issue in this project! 💖

In case you want to claim this issue, please comment down below! We will try to get back to you as soon as we can. 👀

[Haarolean]

Hey @deadmandrive, thanks for reaching out.

Well, honestly, I'd suggest using SSL as it's supposed to work -- with FQDNs :)

But, otherwise, you could try adding this to kafka-ui's properties:
KAFKA_CLUSTERS_0_PROPERTIES_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: ""
Let me know how it goes.

[deadmandrive]

Thank you @Haarolean will try and get back to you.

[deadmandrive]

@Haarolean It working. Thank you so much.

[Haarolean]

@deadmandrive nice, thanks! I'll update the example file.