# Configure Truststores for TLS Handshake with Identity Providers When OAuth is enabled for your Confluent Platform service, the TLS handshake with your identity provider is required to verify the identity of the identity provider. This is achieved using a truststore for each of your Confluent Platform services, which includes the TLS certificate of your identity provider and is configured with the location and password properties. Whether your identity provider uses self-signed TLS certificates or certificates signed by a public Certificate Authority, you need to download the certificate and import it to the truststore for your Confluent Platform service. Follow the steps below to configure the truststore for your Confluent Platform service. ## Step 1 - Download the identity provider TLS certificate Use the following `openssl` command to download the certificate of your identity provider, replacing `` with your actual identity provider URL. ```shell openssl s_client -showcerts \ -connect /dev/null|openssl x509 \ -outform PEM >oktacertfile.pem ``` ## Step 2 - Import the identity provider TLS certificate to the truststore You can use the following `keytool` command to import the certificate to the truststore for your Confluent Platform service. Replace the placeholder values with your actual configuration values. ```shell keytool -import -alias -file .pem \ -storetype JKS \ -keystore \ -storepass \ -noprompt ``` You must restart the corresponding Confluent Platform service for it to reload the truststore. ## Step 3 - Configure the truststore in your Confluent Platform service For each of your Confluent Platform services, configure the truststore with the `ssl.truststore.location` and `ssl.truststore.password` properties. Replace the placeholder values with your actual configuration values. ### Kafka broker ```properties listener.name.external.oauthbearer.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \ ssl.truststore.location="" \ ssl.truststore.password=""; ``` ### Metadata Service (MDS) ```properties confluent.metadata.ssl.truststore.location= confluent.metadata.ssl.truststore.password= ``` ### Confluent Schema Registry ```properties ssl.truststore.location= ssl.truststore.password= ``` ### Confluent REST Proxy #### Embedded ```properties confluent.http.server.ssl.truststore.location= confluent.http.server.ssl.truststore.password= ``` #### Standalone ```properties client.ssl.truststore.location= client.ssl.truststore.password= ``` ### Kafka Connect ```properties ssl.truststore.location=.jks ssl.truststore.password= ``` ### Confluent Control Center #### As a Kafka client ```properties confluent.controlcenter.kafka.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \ clientId="" \ ssl.truststore.location="" \ ssl.truststore.password="" \ clientSecret="" \ scope=""; ``` #### As a REST client ```properties confluent.controlcenter.rest.ssl.truststore.location= confluent.controlcenter.rest.ssl.truststore.password= ``` #### As a Connect client ```properties confluent.controlcenter.connect..ssl.truststore.location= confluent.controlcenter.connect..ssl.truststore.password= ``` ## Configure Confluent Platform services for hostname verification When using a custom TLS context (truststore), hostname verification in TLS certificates is disabled by default. The behavior is inherited from `rest-utils`. For uniformity with Confluent Platform, the prefixed configuration property must be set, replacing `` with the actual Confluent Platform service that you are configuring: ```properties confluent..ssl.endpoint.identification.algorithm=https ``` For example, for Metadata Service (MDS), you need to set the following property: ```properties confluent.metadata.server.ssl.endpoint.identification.algorithm=https ``` If you need to disable the property (for example, when using AWS DNS), delete the configuration property or explicitly set it to blank or empty. ## Related content * [Use OAuth/OIDC for Authentication in Confluent Platform](overview.md#oauth-oidc-authentication-overview) * [Use SASL/OAUTHBEARER Authentication Between Confluent Server Brokers and Kafka Clients in Confluent Platform](../sasl/oauthbearer/overview.md#sasl-oauthbearer-authentication-overview)