[KAFKA-9771] Inter-worker SSL is broken for keystores with multiple certificates

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Component/s: connect
• Assignee: Chris Egerton
• Reporter: Chris Egerton
• Created: 26/Mar/20 21:42
• Updated: 27/Mar/20 17:37
• Resolved: 27/Mar/20 17:37

Description

The recent bump in Jetty version causes inter-worker communication to fail in Connect when SSL is enabled and the keystore for the worker contains multiple certificates (which it might, in the case that SNI is enabled and the worker's REST interface is bound to multiple domain names). This is caused by changes introduced in Jetty 9.4.23, which are later fixed in Jetty 9.4.25.

We recently tried and failed to upgrade to Jetty 9.4.25, so upgrading the Jetty version to fix this issue isn't a viable option. Additionally, the earliest clean version of Jetty (at the time of writing) with regards to CVEs is 9.4.24, so reverting to a pre-9.4.23 version is also not a viable option.

Issue Links

• links to: GitHub Pull Request #8369