[jira] [Created] (KAFKA-13293) Support client reload of PEM certificates

["Elliot West (Jira)" <ji...@apache.org>]

Elliot West created KAFKA-13293:
-----------------------------------

             Summary: Support client reload of PEM certificates
                 Key: KAFKA-13293
                 URL: https://issues.apache.org/jira/browse/KAFKA-13293
             Project: Kafka
          Issue Type: Improvement
          Components: clients, security
    Affects Versions: 2.7.1, 2.8.0, 2.7.0
            Reporter: Elliot West


Since Kafka 2.7.0, clients are able to authenticate using PEM certificates as client configuration properties in addition to JKS file based key stores (KAFKA-10338). With PEM, certificate chains are passed into clients as simple string based key-value properties, alongside existing client configuration. This offers a number of benefits: it provides a JVM agnostic security mechanism from the perspective of clients, removes the client's dependency on the local filesystem, and allows the the encapsulation of the entire client configuration into a single payload.

However, the current client PEM implement has a feature regression when compared with the JKS implementation. With the JKS approach, clients would automatically reload certificates when the key stores were modified on disk. This enables a seamless approach for the replacement of certificates when they are due to expire; no further configuration or explicit interference with the client lifecycle is needed for the client to migrate to renewed certificates.

Such a capability does not currently exist for PEM. One supplies key chains when instantiating clients only - there is no mechanism available to either directly reconfigure the client, or for the client to observe changes to the original properties set reference used in construction. Additionally, no work-arounds are documented that might given users alternative strategies for dealing with expiring certificates. Given that expiration and renewal of certificates is an industry standard practice, it could be argued that the current PEM client implementation is not fit for purpose.

In summary, a mechanism should be provided such that clients can automatically detect, load, and use updated PEM key chains from some non-file based source (object ref, method invocation, listener, etc.)

Finally, It is suggested that in the short-term Kafka documentation be updated to describe any viable mechanism for updating client PEM certs (perhaps closing existing client and then recreating?).



--
This message was sent by Atlassian Jira
(v8.3.4#803005)