Hi all — quick question on the Generic KAFKA Producer connector. We’re configuring it with SASL (username/password) and the broker connection is failing with
Confluent.Kafka.KafkaException: Local: Broker transport failure
while a Kafka consumer using the same broker/creds works. In the Producer element UI we also see fields like Keystore Location, Keystore Password, and CA Certificate Location. Do these need to be filled in when using SASL, or only when the broker requires TLS (e.g., SASL_SSL)? If TLS is required, what’s the expected format/location for the cert/keystore on the DMA and which of those fields are mandatory?
Hi!
No, the Keystore and CA certificate fields are not required when using plain SASL (SASL_PLAINTEXT). They are only required when the Kafka broker uses TLS encryption, such as SASL_SSL or SSL.
Regarding the error Local: Broker transport failure, usually indicates one of these issues:
- Wrong security.protocol
- TLS required but not configured
- Firewall blocking broker port (In my experience, Cofluent was blocked by a firewall in the application layer)
- Broker expects SSL but client uses PLAINTEXT
- advertised.listeners mismatch
Since your consumer works, compare these settings carefully:
security.protocol
sasl.mechanism
sasl.username
sasl.password
bootstrap.servers