KIP-294 — Enable TLS hostname verification by default

Accepted Kafka 2.0 Security

Changes the default value of ssl.endpoint.identification.algorithm from empty string (hostname verification disabled) to 'https' (hostname verification enabled). Without hostname verification, TLS connections are vulnerable to man-in-the-middle attacks even with valid certificates, as the client does not verify that the certificate's CN/SAN matches the broker hostname it connected to.

Details