Skip to content
Kafka Is Fun
SecurityTLS listeners

SSLHandshakeException: PKIX path building failed (TLS handshake with a broker fails)

Checked against Kafka 4.2 · Oct 2026Community draft, not yet reviewed by a Kafka specialist

What it means

The client and the broker could not complete a TLS handshake. Kafka's SSL documentation names the things that must line up: the client's truststore holds the certificate authority that signed the broker's certificate, the certificate matches the host name the client connects to, a client certificate is supplied if the broker requires one, and the client's security.protocol matches the listener.

Quick answer

Read the line after the exception name. A PKIX error means the JVM could not build a trusted path from the broker's certificate to an authority in its truststore. A message about a subject alternative name means the certificate does not list the host you connected to.

Likely causes, most common first

  1. The client does not trust the broker's certificate authority

    How to confirm

    Inspect the certificate the broker presents, and check that the client's truststore contains the authority that signed it. The SSL documentation configures this with ssl.truststore.location and ssl.truststore.password on the client.

    confirm
    openssl s_client -debug -connect broker1.example.com:9093
keytool -list -v -keystore client.truststore.jks

    Fix

    Import the CA certificate into the client truststore, the way the SSL documentation does for its CARoot, and point the client at it.

    fix
    keytool -keystore client.truststore.jks -alias CARoot -import -file ca-cert

  2. The certificate does not match the host name

    How to confirm

    The SSL documentation says clients verify the server's fully qualified domain name or IP address against the certificate's Common Name or its Subject Alternative Name, that using the common name has been deprecated since 2000, and that host name verification has been on by default since Kafka 2.0.0 (ssl.endpoint.identification.algorithm defaults to https).

    Fix

    Issue the certificate with every name clients use in its SAN field, including the host in advertised.listeners. The documentation says verification can be turned off with an empty ssl.endpoint.identification.algorithm, and warns there is normally no good reason to do so beyond getting something to work quickly.

  3. The broker requires a client certificate and the client has none

    How to confirm

    On the broker, ssl.client.auth=required means client authentication is required. (requested means it is asked for but clients without certificates can still connect; the documentation discourages it.)

    Fix

    Give the client a keystore with a certificate signed by an authority the broker trusts: ssl.keystore.location, ssl.keystore.password and ssl.key.password.

  4. The client's security.protocol does not match the listener

    How to confirm

    security.protocol on the client is one of PLAINTEXT, SSL, SASL_PLAINTEXT or SASL_SSL, and it has to match the protocol of the listener you connect to.

    Fix

    Set security.protocol to match the listener, and use that listener's port.

  5. A certificate has expired

    How to confirm

    The certificate's validity dates are in the past. openssl x509 -in certificate.crt -text -noout shows them.

    Fix

    Renew and redeploy the certificate.

Sources

Every claim above comes from these Apache pages, as of Kafka 4.2. If a page does not say it, this entry does not.

Was this helpful?

Report an issue (opens GitHub in a new tab)

Back to all errors