Hi Team, I am using druid v25 and have TLS enabled kafka separately. How I can connect my supervisor with this kafka for data ingestion? What changes we need to do for this?

There is a detailed blog post, PLease check if this helps: https://blog.hellmar-becker.de/2022/07/16/connecting-apache-druid-to-kafka-with-tls-authentication/

@Bibek Sahoo I have already tried this link. Getting error in master node

Caused by: org.apache.kafka.common.errors.SslAuthenticationException: SSL handshake failed
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Is there any specific path in which we have to put all generated certs?

I do not believe there is a specific location. Just make sure the certificate is valid and has proper access to the druid user.

Here are the consumerProperties we have for Kafka + TLS:

"bootstrap.servers": "<redacted>",
        "druid.dynamic.config.provider": {
          "type": "environment",
          "variables": {
            "ssl.key.password": "TLS_KEYSTORE_PASSWORD",
            "ssl.keystore.password": "TLS_KEYSTORE_PASSWORD",
            "ssl.truststore.password": "TLS_TRUSTSTORE_PASSWORD"
          }
        },
        "ssl.keystore.location": "/druid/tls/keystore.jks",
        "ssl.truststore.location": "/druid/tls/truststore.jks",
        "ssl.keystore.type": "JKS",
        "security.protocol": "SSL",
        "ssl.endpoint.identification.algorithm": ""

That last one is there because I read that in some cases it needs to be set like this. It worked and I never tried it without it 🙂

I am running druid in cluster mode (master, datanode & query). I put all required certs in master server, Still getting error. I have tried both of your(@Bibek Sahoo & @Sean G) consumerProperties object. following error is coming for { "bootstrap.servers": "your Kafka service host + port", "security.protocol": "SSL", "ssl.truststore.location": "your home directory/aiven-tls/aiven_cacerts.jks", "ssl.truststore.password": "changeit", "ssl.keystore.location": "your home directory/aiven-tls/aiven_keystore.jks", "ssl.keystore.password": "changeit" }

I believe so.

Is There anything we need to do in common.runtime.properties ?

No, Hope you are following this article: https://blog.hellmar-becker.de/2022/07/16/connecting-apache-druid-to-kafka-with-tls-authentication/

Yes, We are referring the same article

As Bibek mentioned, all of the servers should be configured with the certificate information. The trust store should have all appropriate root and intermediate certs included. We do have the information configured in the common.runtime.properties as well, although that is for Druid TLS connections and not Kafka ones. Make sure your private key is signed and has the appropriate FQDN SAN entries, that is if you are using mTLS