Troubleshoot Mutual TLS (mTLS) issues in Confluent Cloud¶
Review the following to troubleshoot issues frequently encountered when connecting to Confluent Cloud using mTLS. If you are unable to resolve issues using the information below, contact Confluent Support.
TLS client connection behavior¶
The following listings describe the behavior of the TLS client when connecting to Confluent Cloud using mTLS.
- Context is a single Confluent Cloud organization.
- “N/A” means that the state of the subject is not considered.
Early Access¶
During Early Access only:
Certificate revocation can only be done directly using the filter to immediately remove access to revoked certificates.
The client certificate chain is not automatically built, if not provided.
If only a leaf certificate is provided, the following error might occur:
Must be only one matching identity provider found when building principal for mTLS authenticated client of AuthenticationException.
To resolve this issue, provide the full leaf-to-root certificate chain.
Client connection behavior (TLS)¶
Client connection (TLS) | Identity providers (for CA certificates) [server state] | Certificate identity pools (of identity provider) [server state] | Permission on certificate identity pool (to perform action on resource) [server state] | Outcome (client-side) | Explanation |
---|---|---|---|---|---|
Without keystore | N/A | N/A | N/A | Request timed out | The client doesn’t provide a certificate, so it doesn’t have authentication information, resulting in a timed out response. |
With keystore but client certificate is expired | N/A | N/A | N/A | TLS handshake error | Because the client certificate is expired, the TLS handshake fails. |
With keystore and client certificate is not expired | No identity provider | N/A | N/A | Request timed out | The server doesn’t have information to verify the client certificate, resulting in an authentication error that leads to a timed out response. |
With keystore and client certificate is not expired | Identity provider signs client certificate but CA certificates are expired | N/A | N/A | Request timed out | Confluent routinely removes expired CA certificates from the truststore. Just like the no identity provider situation, this leads to a timed out response on the client. If the CA needs to be revoked immediately, then the corresponding certificate authority can be deleted from the Confluent Cloud organization after removing the CA’s attached certificate identity pools. |
With keystore and client certificate is not expired | Identity provider signs client certificate | No matching certificate identity pool found | N/A | Request timed out | When no certificate identity pool is found for the identity provider, an authentication error occurs, leading to a timed out response for the client. |
With keystore and client certificate is not expired | Identity provider signs client certificate | With certificate identity pool | No | Authorization error | If the principal doesn’t have permission to perform an action on a resource, an authorization error is expected. |
With keystore and client certificate is not expired | Identity provider signs client certificate | With certificate identity pool | Yes | Request successful | The client is authenticated successfully. |
With librdkafka-based SSL/SASL_SSL client | Identity provider signs client certificate | Without certificate identity pool | No | TLS handshake error | Confirm that the corresponding certificate authority configured in Confluent Cloud contains the signing certificate of the client certificate in the client keystore. |