Help with self signed ssl certificates

[ChadDa3mon]

Hey guys,

I love what you're doing here and want to try it for my next project but I've never figured out how to make aiokafka work with our dev environment, where there's self-signed SSL certificates. I've tried something like

ssl_context = ssl.create_default_context()
ssl_context.check_hostname = False
ssl_context.verify_mode = ssl.CERT_NONE

But it never works. I assume that's the issue preventing this from working. The only way I've gotten things to work is with the confluent kafka where I have a setup like this:

kafka_consumer_settings = {
    "bootstrap.servers": kafka_host,
    "group.id": kafka_consumer_group_id,
    "security.protocol": "SASL_SSL",
    "sasl.username": kafkaUser,
    "sasl.password": kafkaPass,
    "sasl.mechanisms": "PLAIN",
    "enable.ssl.certificate.verification": "False",
    "heartbeat.interval.ms": 1000,
    "auto.offset.reset": "latest", 
    "session.timeout.ms": 6000,
    "enable.auto.commit": True,  
    "api.version.request": False
}

If anyone has any ideas I'd love to see this work. Even if not, I think this is a fantastic idea and only wish I could help more.

[sternakt]

Hi! Fist of all, thank you for the kind words 😄

Have you checked out our guide for enabling authentication in FastStream?
This should enable you to use sasl_ssl security in your connection.

From what I can see, your configuration should look something like this:

import ssl

from faststream import FastStream
from faststream.broker.security import SASLPlaintext
from faststream.kafka import KafkaBroker

ssl_context = ssl.create_default_context()
ssl_context.check_hostname = False
ssl_context.verify_mode = ssl.CERT_NONE

security = SASLPlaintext(ssl_context=ssl_context, username=kafkaUser, password=kafkaPass)

broker = KafkaBroker(kafka_host, security=security)
app = FastStream(broker)

If you tried this already, please let us know what is the error you are getting so that we can possibly debug what is going wrong in the security configuration when connecting to the broker.

[ChadDa3mon]

I did try your guides but they don't address this at all, and they're a bit over my head as well. Between ChatGPT and myself I was eventually able to get this work with a similar config as you posted above, thanks :)

[sternakt]

Great to hear 😄
Could you share what was the final configuration?
So that we know if somebody has a similar issue