javax.net.ssl.SSLHandshakeException: No subject alternative DNS name #1675

jphuguet · 2022-02-24T08:30:05Z

jphuguet
Feb 24, 2022

Describe the bug
Local kafka-ui (latest) running in docker fails to connect to an ainven kafka cluster.

It seems that kafka-ui reach the cluster kafka_cluster.aivencloud.com but then resolve it to an EC2 isntance dns ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com.
The provided ca cert matches kafka_cluster.aivencloud.com (it's provided by aiven).
(dns & ip have been changed in the example)

Error :

 javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com found.

Set up
Custom docker image :

FROM provectuslabs/kafka-ui:master

COPY cluster.cert /cluster.cert
RUN echo yes | keytool -import -file "/cluster.cert" -keystore "/etc/ssl/certs/java/cacerts" -storepass "changeit"

Steps to Reproduce

docker run --name kafkaui -p 8080:8080 \
    -e KAFKA_CLUSTERS_0_NAME="kafka_cluster" \
    -e KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS="kafka_cluster.aivencloud.com:11137" \
    -e KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL="SASL_SSL" \
    -e KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM="SCRAM-SHA-512" \
    -e KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG="org.apache.kafka.common.security.scram.ScramLoginModule required username=<Username> password=<Password>;" \
    -d kafka-ui:latest

Expected behavior
Kafka-ui should be connected to the aiven cluster

Logst


  _  __      __ _               _   _ ___
 | |/ /__ _ / _| | ____ _      | | | |_ _|
 | ' // _` | |_| |/ / _` |_____| | | || |
 | . \ (_| |  _|   < (_| |_____| |_| || |
 |_|\_\__,_|_| |_|\_\__,_|      \___/|___|


�[30m2022-02-24 08:06:13,262�[0;39m �[34mINFO �[0;39m [�[34mbackground-preinit�[0;39m] �[33mo.h.v.i.u.Version�[0;39m: HV000001: Hibernate Validator 6.2.0.Final
�[30m2022-02-24 08:06:13,283�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mc.p.k.u.KafkaUiApplication�[0;39m: Starting KafkaUiApplication using Java 13.0.9 on 7f9e50dbbcc9 with PID 1 (/kafka-ui-api.jar started by root in /)
�[30m2022-02-24 08:06:13,284�[0;39m �[39mDEBUG�[0;39m [�[34mmain�[0;39m] �[33mc.p.k.u.KafkaUiApplication�[0;39m: Running with Spring Boot v2.5.6, Spring v5.3.12
�[30m2022-02-24 08:06:13,284�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mc.p.k.u.KafkaUiApplication�[0;39m: No active profile set, falling back to default profiles: default
�[30m2022-02-24 08:06:13,928�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mo.s.d.r.c.RepositoryConfigurationDelegate�[0;39m: Bootstrapping Spring Data LDAP repositories in DEFAULT mode.
�[30m2022-02-24 08:06:13,950�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mo.s.d.r.c.RepositoryConfigurationDelegate�[0;39m: Finished Spring Data repository scanning in 17 ms. Found 0 LDAP repository interfaces.
�[30m2022-02-24 08:06:14,344�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mo.s.b.a.s.r.ReactiveUserDetailsServiceAutoConfiguration�[0;39m: 

Using generated security password: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

�[30m2022-02-24 08:06:14,468�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mc.p.k.u.s.DeserializationService�[0;39m: Using SchemaRegistryAwareRecordSerDe for cluster 'kafka_cluster'
�[30m2022-02-24 08:06:14,734�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mo.s.b.a.e.w.EndpointLinksResolver�[0;39m: Exposing 2 endpoint(s) beneath base path '/actuator'
�[30m2022-02-24 08:06:14,802�[0;39m �[31mWARN �[0;39m [�[34mmain�[0;39m] �[33mc.p.k.u.c.a.DisabledAuthSecurityConfig�[0;39m: Authentication is disabled. Access will be unrestricted.
�[30m2022-02-24 08:06:14,881�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mo.s.l.c.s.AbstractContextSource�[0;39m: Property 'userDn' not set - anonymous context will be used for read-write operations
�[30m2022-02-24 08:06:15,037�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mo.s.b.w.e.n.NettyWebServer�[0;39m: Netty started on port 8080
�[30m2022-02-24 08:06:15,048�[0;39m �[34mINFO �[0;39m [�[34mmain�[0;39m] �[33mc.p.k.u.KafkaUiApplication�[0;39m: Started KafkaUiApplication in 2.219 seconds (JVM running for 2.841)
�[30m2022-02-24 08:06:15,067�[0;39m �[39mDEBUG�[0;39m [�[34mparallel-1�[0;39m] �[33mc.p.k.u.s.ClustersMetricsScheduler�[0;39m: Start getting metrics for kafkaCluster: kafka_cluster
�[30m2022-02-24 08:06:15,075�[0;39m �[34mINFO �[0;39m [�[34mparallel-1�[0;39m] �[33mo.a.k.c.a.AdminClientConfig�[0;39m: AdminClientConfig values: 
	bootstrap.servers = [kafka_cluster.aivencloud.com:11137]
	client.dns.lookup = use_all_dns_ips
	client.id = 
	connections.max.idle.ms = 300000
	default.api.timeout.ms = 60000
	metadata.max.age.ms = 300000
	metric.reporters = []
	metrics.num.samples = 2
	metrics.recording.level = INFO
	metrics.sample.window.ms = 30000
	receive.buffer.bytes = 65536
	reconnect.backoff.max.ms = 1000
	reconnect.backoff.ms = 50
	request.timeout.ms = 30000
	retries = 2147483647
	retry.backoff.ms = 100
	sasl.client.callback.handler.class = null
	sasl.jaas.config = [hidden]
	sasl.kerberos.kinit.cmd = /usr/bin/kinit
	sasl.kerberos.min.time.before.relogin = 60000
	sasl.kerberos.service.name = null
	sasl.kerberos.ticket.renew.jitter = 0.05
	sasl.kerberos.ticket.renew.window.factor = 0.8
	sasl.login.callback.handler.class = null
	sasl.login.class = null
	sasl.login.refresh.buffer.seconds = 300
	sasl.login.refresh.min.period.seconds = 60
	sasl.login.refresh.window.factor = 0.8
	sasl.login.refresh.window.jitter = 0.05
	sasl.mechanism = SCRAM-SHA-512
	security.protocol = SASL_SSL
	security.providers = null
	send.buffer.bytes = 131072
	socket.connection.setup.timeout.max.ms = 30000
	socket.connection.setup.timeout.ms = 10000
	ssl.cipher.suites = null
	ssl.enabled.protocols = [TLSv1.2, TLSv1.3]
	ssl.endpoint.identification.algorithm = https
	ssl.engine.factory.class = null
	ssl.key.password = null
	ssl.keymanager.algorithm = SunX509
	ssl.keystore.certificate.chain = null
	ssl.keystore.key = null
	ssl.keystore.location = null
	ssl.keystore.password = null
	ssl.keystore.type = JKS
	ssl.protocol = TLSv1.3
	ssl.provider = null
	ssl.secure.random.implementation = null
	ssl.trustmanager.algorithm = PKIX
	ssl.truststore.certificates = null
	ssl.truststore.location = null
	ssl.truststore.password = null
	ssl.truststore.type = JKS

�[30m2022-02-24 08:06:15,143�[0;39m �[34mINFO �[0;39m [�[34mparallel-1�[0;39m] �[33mo.a.k.c.s.a.AbstractLogin�[0;39m: Successfully logged in.
�[30m2022-02-24 08:06:15,212�[0;39m �[34mINFO �[0;39m [�[34mparallel-1�[0;39m] �[33mo.a.k.c.u.AppInfoParser�[0;39m: Kafka version: 2.8.0
�[30m2022-02-24 08:06:15,212�[0;39m �[34mINFO �[0;39m [�[34mparallel-1�[0;39m] �[33mo.a.k.c.u.AppInfoParser�[0;39m: Kafka commitId: ebb1d6e21cc92130
�[30m2022-02-24 08:06:15,212�[0;39m �[34mINFO �[0;39m [�[34mparallel-1�[0;39m] �[33mo.a.k.c.u.AppInfoParser�[0;39m: Kafka startTimeMs: 1645689975211
�[30m2022-02-24 08:06:15,844�[0;39m �[34mINFO �[0;39m [�[34mkafka-admin-client-thread | adminclient-1�[0;39m] �[33mo.a.k.c.n.Selector�[0;39m: [AdminClient clientId=adminclient-1] Failed authentication with ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com/54.xx.xx.xx (SSL handshake failed)
�[30m2022-02-24 08:06:15,847�[0;39m �[1;31mERROR�[0;39m [�[34mkafka-admin-client-thread | adminclient-1�[0;39m] �[33mo.a.k.c.NetworkClient�[0;39m: [AdminClient clientId=adminclient-1] Connection to node 8 (ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com/54.xx.xx.xx:11137) failed authentication due to: SSL handshake failed
�[30m2022-02-24 08:06:15,850�[0;39m �[31mWARN �[0;39m [�[34mkafka-admin-client-thread | adminclient-1�[0;39m] �[33mo.a.k.c.a.i.AdminMetadataManager�[0;39m: [AdminClient clientId=adminclient-1] Metadata update failed due to authentication error
org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com found.
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:325)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:268)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:263)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:445)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1247)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1192)
	at org.apache.kafka.common.network.SslTransportLayer.runDelegatedTasks(SslTransportLayer.java:430)
	at org.apache.kafka.common.network.SslTransportLayer.handshakeUnwrap(SslTransportLayer.java:514)
	at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:368)
	at org.apache.kafka.common.network.SslTransportLayer.handshake(SslTransportLayer.java:291)
	at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:178)
	at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:543)
	at org.apache.kafka.common.network.Selector.poll(Selector.java:481)
	at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:561)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.processRequests(KafkaAdminClient.java:1333)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1264)
	at java.base/java.lang.Thread.run(Thread.java:830)
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com found.
	at java.base/sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:212)
	at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:103)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:452)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:412)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:292)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632)
	... 19 common frames omitted
�[30m2022-02-24 08:06:15,851�[0;39m �[1;31mERROR�[0;39m [�[34mkafka-admin-client-thread | adminclient-1�[0;39m] �[33mc.p.k.u.s.MetricsService�[0;39m: Failed to collect cluster kafka_cluster info
java.lang.IllegalStateException: Error while creating AdminClient for Cluster kafka_cluster
	at com.provectus.kafka.ui.service.AdminClientServiceImpl.lambda$createAdminClient$3(AdminClientServiceImpl.java:44)
	at reactor.core.publisher.Mono.lambda$onErrorMap$31(Mono.java:3732)
	at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onError(FluxOnErrorResume.java:94)
	at reactor.core.publisher.FluxMapFuseable$MapFuseableSubscriber.onError(FluxMapFuseable.java:140)
	at reactor.core.publisher.MonoFlatMap$FlatMapMain.onError(MonoFlatMap.java:172)
	at reactor.core.publisher.MonoCreate$DefaultMonoSink.error(MonoCreate.java:194)
	at com.provectus.kafka.ui.service.ReactiveAdminClient.lambda$toMono$1(ReactiveAdminClient.java:97)
	at org.apache.kafka.common.internals.KafkaFutureImpl$WhenCompleteBiConsumer.accept(KafkaFutureImpl.java:175)
	at org.apache.kafka.common.internals.KafkaFutureImpl$WhenCompleteBiConsumer.accept(KafkaFutureImpl.java:162)
	at org.apache.kafka.common.internals.KafkaFutureImpl.completeExceptionally(KafkaFutureImpl.java:238)
	at org.apache.kafka.clients.admin.KafkaAdminClient$5.handleFailure(KafkaAdminClient.java:1896)
	at org.apache.kafka.clients.admin.KafkaAdminClient$Call.fail(KafkaAdminClient.java:798)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.maybeDrainPendingCall(KafkaAdminClient.java:1059)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.maybeDrainPendingCalls(KafkaAdminClient.java:1032)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.processRequests(KafkaAdminClient.java:1310)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1264)
	at java.base/java.lang.Thread.run(Thread.java:830)
Caused by: org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative DNS name matching ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com found.
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:325)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:268)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:263)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:445)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1247)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:691)
	at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1192)
	at org.apache.kafka.common.network.SslTransportLayer.runDelegatedTasks(SslTransportLayer.java:430)
	at org.apache.kafka.common.network.SslTransportLayer.handshakeUnwrap(SslTransportLayer.java:514)
	at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:368)
	at org.apache.kafka.common.network.SslTransportLayer.handshake(SslTransportLayer.java:291)
	at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:178)
	at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:543)
	at org.apache.kafka.common.network.Selector.poll(Selector.java:481)
	at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:561)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.processRequests(KafkaAdminClient.java:1333)
	at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1264)
	at java.base/java.lang.Thread.run(Thread.java:830)
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching ec2-54-xx-xx-xx.eu-west-1.compute.amazonaws.com found.
	at java.base/sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:212)
	at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:103)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:452)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:412)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:292)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632)
	... 19 common frames omitted

2022-02-24T08:30:41Z

github-actions[bot]
bot Feb 24, 2022

Hello there jphuguet! 👋

Thank you and congratulations 🎉 for opening your very first issue in this project! 💖

In case you want to claim this issue, please comment down below! We will try to get back to you as soon as we can. 👀

0 replies

5hin0bi · 2022-02-24T14:09:22Z

5hin0bi
Feb 24, 2022

Hi @jphuguet thank you for opening the issue.

Is it possible we could proceed on this in our discord? https://discord.gg/32yuC2qS

Please let us know. We would be happy to try to help you.

3 replies

5hin0bi Feb 24, 2022

According to the error it was thrown by the SSL library itself. We cannot do anything with it. It can be solved only by sticking to SSL connection requirements.

You can check details of this stackoverflow post that clarifies the problem: https://stackoverflow.com/questions/29157861/java-certificateexception-no-subject-alternative-names-matching-ip-address

To cut a long story short, the certificate you are using lacks the SAN of type 2 that corresponds your ec2 dns name.

I hope it helps.

jphuguet Feb 25, 2022
Author

Thanks for your answer @5hin0bi, I came to the same conclusion, unfortunately this cert in managed by aiven so we can't add any SANs.

What I don't understand is why kafka-ui tries to reach the ec2 dns (that we are not aware of, as the cluster is manager by aiven).
There would not be any issue using the KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS we provide.

5hin0bi Feb 25, 2022

Hi @jphuguet.

Unfortunately, this is how the secure web connectivity works - it's not the Kafka-ui itself at all. For more information you can check this information on this: https://networkencyclopedia.com/host-name-resolution/

Probably some additional configuration of your Aiven environment might help to get the proper certificate.

jphuguet · 2022-02-25T14:09:23Z

jphuguet
Feb 25, 2022
Author

ok, thank you @5hin0bi

My point is that I provide a bootstrap fqdn kafka_cluster.aivencloud.com
If I dig it, I see 3 IP address.
A host on any of these address targets an EC2 instance like ec2-34-xxx-xxx-xx.eu-west-1.compute.amazonaws.com.

Maybe I'm really missing something or don't understand anything but it seems that at some point a reverse dns lookup is done on one of the IP and that the answer (a EC2 dns) is then used by kafka-ui.

1 reply

wanisfahmyDE Nov 25, 2022

Hi @jphuguet were you able to solve that? had to revert to client certs to make that works but sasl/scram not :/

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

javax.net.ssl.SSLHandshakeException: No subject alternative DNS name #1675

{{title}}

Replies: 3 comments 4 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

javax.net.ssl.SSLHandshakeException: No subject alternative DNS name #1675

jphuguet Feb 24, 2022

Replies: 3 comments · 4 replies

github-actions[bot] bot Feb 24, 2022

5hin0bi Feb 24, 2022

5hin0bi Feb 24, 2022

jphuguet Feb 25, 2022 Author

5hin0bi Feb 25, 2022

jphuguet Feb 25, 2022 Author

wanisfahmyDE Nov 25, 2022

jphuguet
Feb 24, 2022

Replies: 3 comments 4 replies

github-actions[bot]
bot Feb 24, 2022

5hin0bi
Feb 24, 2022

jphuguet Feb 25, 2022
Author

jphuguet
Feb 25, 2022
Author