Q&A: How to list the certificates in use for Windows.

[uberDoward]

Description

I am unable to get kaka dotnet to use a certificate from the local machine Windows Certificate Store.

How to reproduce

Enable debug all in producer. Load certificate to be used in local machine MY store. Attempt to connect.

Checklist

Please provide the following information:

• [ ] A complete (i.e. we can run it), minimal program demonstrating the problem. No need to supply a project file.
• [1.6.3] Confluent.Kafka nuget version.
• [ ] Apache Kafka version.
• [ ] Client configuration.
• [Windows] Operating system.
• [ ] Provide logs (with "debug" : "..." as necessary in configuration).
• [ ] Provide broker log excerpts.
• [ ] Critical issue.

[edenhill]

The client uses the ROOT store by default, you can specify what stores to use with the SslCaCertificateStores config property

Comma-separated list of Windows Certificate stores to load CA certificates from. Certificates will be loaded in the same order as stores are specified. If no certificates can be loaded from any of the specified stores an error is logged and the OpenSSL library's default CA location is used instead. Store names are typically one or more of: MY, Root, Trust, CA.
Type: string

[uberDoward]

Yes, I am using the My store. I can see that 8 certificates are loaded, from the [CERTSTORE] logs.

How do I tell Kafka which specific certificate to use?

[edenhill]

It'll use all loaded certs to verify the broker certificate.

[uberDoward]

Understood. Will the broker's CA cert need to be in the same store?

Also, any idea why the local machine store is not checked? Appears to be user certificate store only...

[edenhill]

The dotnet client only uses the cert stores as CA certificates for verifying the broker certificate, nothing else.

[uberDoward]

Interesting. If I set up as SslKeystoreLocation = "c:\path\to\cert.pfx" and supply the SslKeystorePassword (there is a password on the pfx), it works fine.

If I set SslCaCertificateStores = "My" and load the same cert to my user cert store, I get error:1408E0F4: SSL routines:ssl3_get_message: unexpected message: client SSL authentication might be required

Edit

This is with EnableSslCertificateVerification = false. If I set that to true, I get a different error stating broker certificate could not be verified.

[Coldplayer1995]

Have exactly the same problem with broker certificate could not be verified ;/ using the keystorelocation and cacert.