You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When using the Kafka Java client with TLS and SNI host names users get the following error
Caused by: java.lang.IllegalArgumentException: Server name value of host_name cannot have the trailing dot
at java.base/javax.net.ssl.SNIHostName.checkHostName(SNIHostName.java:319)
at java.base/javax.net.ssl.SNIHostName.<init>(SNIHostName.java:109)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:212)
HostName" contains the fully qualified DNS hostname of the server, as
understood by the client. The encoded server name value of a hostname is
represented as a byte string using ASCII encoding without a trailing dot.
This allows the support of Internationalized Domain Names (IDN) through
the use of A-labels (the ASCII-Compatible Encoding (ACE) form of a valid
string of Internationalized Domain Names for Applications (IDNA)) defined
The text was updated successfully, but these errors were encountered:
IIUC, a trailing . loosely means "match this domain exactly as is. Do NOT use search domains". In a Kubernetes cluster, redpanda-0.redpanda.panda will generally get matched to redpanda-0.redpanda.panda.svc.cluster.local. Adding a trailing dot would prevent that match.
There's a lot of interesting issues on this floating around the internet. Which I'm not going to link because github will connect them to each other.
Based off the slack thread that spawned this issue, it seems the particular limitation is SNI not working with trailing periods.
I'm not opposed to removing the trailing dot though we'll need to check how our TLS certs are configured. If they have trailing .'s as well, we'll need to be careful about removing it.
Currently for internal only domain names we have a trailing
.
. This is called out here: https://github.com/redpanda-data/helm-charts/blob/main/charts/redpanda/helpers.go#L141.When using the Kafka Java client with TLS and SNI host names users get the following error
We should change the internal domain names so that they are valid per http://www.ietf.org/rfc/rfc6066.txt
The text was updated successfully, but these errors were encountered: