Cp-docker-images: kafka-cluster-ssl: SSL handshake failed when docker-compose up "No name matching localhost found"

[yohei1126]

Brokers can reach each other via URI in KAFKA_ADVERTISED_LISTENERS but it failes to connect during TLS handshake.
KAFKA_ADVERTISED_LISTENERS: SSL://localhost:39092

$ docker-compose up --remove-orphans
...
kafka-ssl-1_1  | org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
kafka-ssl-1_1  | Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
kafka-ssl-1_1  |    at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1529)
kafka-ssl-1_1  |    at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
kafka-ssl-1_1  |    at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1214)
kafka-ssl-1_1  |    at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1186)
kafka-ssl-1_1  |    at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.SslTransportLayer.handshakeWrap(SslTransportLayer.java:439)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:304)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.SslTransportLayer.handshake(SslTransportLayer.java:258)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:134)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:487)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.Selector.poll(Selector.java:425)
kafka-ssl-1_1  |    at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:510)
kafka-ssl-1_1  |    at org.apache.kafka.clients.NetworkClientUtils.awaitReady(NetworkClientUtils.java:73)
kafka-ssl-1_1  |    at kafka.controller.RequestSendThread.brokerReady(ControllerChannelManager.scala:279)
kafka-ssl-1_1  |    at kafka.controller.RequestSendThread.doWork(ControllerChannelManager.scala:233)
kafka-ssl-1_1  |    at kafka.utils.ShutdownableThread.run(ShutdownableThread.scala:82)
kafka-ssl-1_1  | Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
kafka-ssl-1_1  |    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
kafka-ssl-1_1  |    at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728)
kafka-ssl-1_1  |    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:330)
kafka-ssl-1_1  |    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
kafka-ssl-1_1  |    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
kafka-ssl-1_1  |    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
kafka-ssl-1_1  |    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
kafka-ssl-1_1  |    at sun.security.ssl.Handshaker$1.run(Handshaker.java:992)
kafka-ssl-1_1  |    at sun.security.ssl.Handshaker$1.run(Handshaker.java:989)
kafka-ssl-1_1  |    at java.security.AccessController.doPrivileged(Native Method)
kafka-ssl-1_1  |    at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.SslTransportLayer.runDelegatedTasks(SslTransportLayer.java:393)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.SslTransportLayer.handshakeUnwrap(SslTransportLayer.java:473)
kafka-ssl-1_1  |    at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:331)
kafka-ssl-1_1  |    ... 9 more
kafka-ssl-1_1  | Caused by: java.security.cert.CertificateException: No name matching localhost found
kafka-ssl-1_1  |    at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:231)
kafka-ssl-1_1  |    at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
kafka-ssl-1_1  |    at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
kafka-ssl-1_1  |    at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
kafka-ssl-1_1  |    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:252)
kafka-ssl-1_1  |    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
kafka-ssl-1_1  |    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1601)
...

[yohei1126]

https://java.globinch.com/enterprise-java/security/fix-java-security-certificate-exception-no-matching-localhost-found/

[yohei1126]

Testing with this docker-compose.yml https://github.com/yohei1126/cp-docker-images/blob/fix-ssl-cluster/examples/kafka-cluster-ssl/docker-compose.yml

still got this error

broker3.test.confluent.io_1  | Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
broker3.test.confluent.io_1  |  at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
broker3.test.confluent.io_1  |  at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)

[Mongey]

I believe this is cause by KIP-294.

Setting the following ENV variables to blank bypassed the errors for me.

ENV KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM=
ENV KAFKA_LISTENER_NAME_INTERNAL_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM=