Implementing encryption in Kafka means enabling SSL/TLS on broker and client listeners so all data moving between clients and brokers, and between brokers themselves, is encrypted rather than sent in plaintext.
Key Points: • Generate a certificate and private key for each broker, signed by a CA (self-managed or public), and store it in a keystore. • Configure each broker with its keystore and a truststore containing the CA certificate so it can validate client certificates if mutual TLS is used. • Configure every client (producers, consumers, admin tools) with a matching truststore, and a keystore too if mutual TLS authentication is required. • Enable an SSL listener on the brokers (e.g. SSL://host:9093) separate from or replacing the plaintext listener, and point clients at that listener. • Test connectivity end-to-end and monitor handshake failures, since certificate mismatches are the most common cause of connection errors after enabling TLS.
Example: After generating broker and client certificates signed by an internal CA, a team points every producer and consumer's bootstrap.servers at the SSL listener and confirms in broker logs that connections are negotiating TLS successfully instead of falling back to plaintext.
Code Example:
# broker (server.properties)
listeners=SSL://0.0.0.0:9093
ssl.keystore.location=/etc/kafka/ssl/broker.keystore.jks
ssl.keystore.password=changeit
ssl.truststore.location=/etc/kafka/ssl/broker.truststore.jks
ssl.truststore.password=changeit
# client (producer/consumer)
security.protocol=SSL
ssl.truststore.location=/etc/kafka/ssl/client.truststore.jks
ssl.truststore.password=changeitInterview Tip: A concise interview answer is:
"I'd generate CA-signed certificates for each broker and client, configure keystores and truststores on both sides, enable an SSL listener on the brokers, and point all clients' security.protocol at SSL, verifying with a test connection that the TLS handshake is actually succeeding before rolling it out cluster-wide."