KIP-1354 — Single purpose TLS extended key usages (EKU) support

Discussion SecurityBrokerConnect

Adds an ssl.client.* config family (plus listeners.client.https.* for Connect and MirrorMaker 2 workers) that supplies a separate client-role keystore, resolved onto the base ssl.* keys when a channel is built in ConnectionMode.CLIENT and scoped per listener. Public CAs are phasing out multipurpose certificates carrying both serverAuth and clientAuth EKUs, and JSSE enforces EKU per handshake role, so a broker, controller, or worker with a single serverAuth keystore can accept connections but fails every outbound inter-broker, broker-to-controller, quorum, or inter-worker mTLS dial.

Details