Kafka Configs Kafka Protocol Wire Format API Versions KIPs Errors Kafka Upgrade Config Advisor Flink SQL
conduktor.io ↗
KIPs / KIP-684

KIP-684 — Support mutual TLS authentication on SASL_SSL listeners

Accepted Kafka 2.8 Security

Enables mutual TLS (mTLS) client authentication on `SASL_SSL` listeners by honoring the `ssl.client.auth` broker configuration for those listeners. Kafka currently ignores `ssl.client.auth` on `SASL_SSL` listeners, preventing operators from requiring TLS client certificates in addition to SASL credentials for defense-in-depth authentication.

Details

AuthorRajini Sivaram
StatusAccepted
Kafka Version2.8
JIRAKAFKA-10700
WikiView on Apache Wiki
Created2020-11-09
Last Modified2021-03-03
Explore how this KIP affects the Kafka protocol in the Protocol Explorer, or see the full KIP database.