Kafka Configs Kafka Protocol Wire Format API Versions KIPs Errors Exceptions Kafka Upgrade Config Advisor Policy Pack
Debezium
Config Matrix Event Envelope Snapshot Modes Error Reference
Flink SQL
conduktor.io ↗
KIPs / KIP-553

KIP-553 — Disable all SSL protocols except TLSV1.2 by default.

Accepted Kafka 2.5 Security

Changes the default value of `ssl.enabled.protocols` from `TLSv1,TLSv1.1,TLSv1.2` to `TLSv1.2` (and `TLSv1.3` where supported by the JDK) to enforce use of modern TLS versions by default. TLS 1.0 and 1.1 are deprecated by RFC 8446 and considered cryptographically weak, so shipping Kafka with them enabled by default exposes clusters to known downgrade attacks.

Details

AuthorNikolay Izhikov
StatusAccepted
Kafka Version2.5
JIRAKAFKA-9460
WikiView on Apache Wiki
Created2019-12-24
Last Modified2020-02-21
Explore how this KIP affects the Kafka protocol in the Protocol Explorer, or see the full KIP database.