Context
I have a kafka cluster that has been running for a few years. Recent debian and openssl versions started complaining about our certificates and certificate authority with ca md too weak. We temporarily fixed this by lowering the openssl requirements with SECLEVEL=0.
We now want to update our certificates and CA without forcing all clients of the kafka cluster to update their configuration at the same time: it’s hundreds of clients, turning them off and on again is not feasible.
What I tried
- I tried creating a new CA and new signed certificates for the brokers, I installed them but when I tested the connection with openssl, it still complained about the weakness of the certs and CA: it seems kafka is still using the old certificates and CA to serve the SSL connection. This might be because the new certificates have the same CN (Common Name) of the old ones, but it’s just a guess.
- I tried renaming the keys in the broker keystores: apparently this reorders them, making kafka use the new certificates (good!) but rejecting calls made from old clients using the old certificates (bad)
Question
How can I make kafka accepts SSL connections using both old and new certificates, so that I can gradually upgrade all the clients without causing any outage?