2

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides?

More info if helpful:

I'm trying to test how I'd setup having Java application connecting to Kafka 2.1. I am using the same keystore and truststore for the Kafka cluster and the Java application, meaning both sides of the connection have the same public and private key. I understand this is not good practice, I just wanted to verify I understood how to configure things.

I can set 

listeners=PLAINTEXT://localhost:9092,SSL://localhost:9093
# This is the config style for 2.3
# listeners=HTTP://localhost:9092,HTTPS://localhost:9093
ssl.keystore.location=/path/to/kafka.keystore.jks
ssl.keystore.password=test

ssl.truststore.location: /path/to/kafka.truststore.jks
ssl.truststore.password: test

ssl.key.password=test

a bunch of properties in Kafka to enable TLS/SSL authentication. I feel confident that I've made the truststore and keystore correctly, where the truststore contains the 1 public key that the java side and the kafka side are using. I've done the same on the java side, roughly following a GitHub example.

I can't get any connection going, and I am trying to remove possibilities for why. Could this be because both sides of the connection have the same public and private key?

Improve this question
4
  • From a security standpoint, you shouldn't be doing that. For a functional answer (i.e., how does the application behave in this scenario), you should probably ask on the Kafka project site or the ServerFault/SuperUser StackExchange sites.
    – DoubleD
    Jan 17, 2020 at 17:02
  • @DoubleD, security: completely understand. I'm just trying to verify I can configure things to connect; when this goes into prod it will use real signed certs. Functional: it sounds like you're saying there's nothing in standard TLS implementations that would prevent this, but can't say whether Java / Kafka have special rules to prevent this behavior, is that correct?
    – jeremysprofile
    Jan 17, 2020 at 17:11
  • I doubt that the cause of the problem is the use of the same key pair on both sides since there is no restriction in TLS itself which prevents this. But if all you have as error is "I can't get any connection going," then you will have a hard time to figure out whats going on. Have a look into error outputs, log files and packet captures instead to narrow down the problem.
    – Steffen Ullrich
    Jan 17, 2020 at 17:45
  • @SteffenUllrich, thanks. That was my main question; I'm willing to figure out the connectivity stuff on my own (or at least, make a post in the right SE network about it). If you or DoubleD make your comment an answer, I'll accept it so others don't waste their time on this question.
    – jeremysprofile
    Jan 17, 2020 at 17:47

2 Answers 2

Reset to default
4

There is no restriction in TLS itself which prevents using the same key pair on both sides of the connection. It is not really a good idea since a private key should be kept private (which it really isn't when shared between client and server) but it should nevertheless work.

Improve this answer
0

To have the same private key on both sides of a connection is the same as having a simetric key and is fine as long as the key distribution channel and storage are secure.

I would suggest you to have different keys for the Kafka and java app even if you use the shared keystore. This will make easier to separate things in the future if necessary.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .