Skip to main content
AutoMQ supports SASL authentication with Kafka ACL users. Use SASL_PLAINTEXT only on a trusted private network. Use SASL_SSL to encrypt client traffic with TLS.

​
Enable SASL_PLAINTEXT

​
Server configuration

When you create the instance, enable SASL authentication and the SASL_PLAINTEXT listener. Create an ACL user and grant only the Topic and Consumer Group permissions required by the application.

​
Client configuration

Configure the Kafka client with the credentials created in AutoMQ. The following example uses SASL/PLAIN:

​
Enable SASL_SSL

SASL_SSL combines SASL client authentication with TLS server authentication and transport encryption. Server certificate responsibilities depend on the DNS Zone mode selected when the instance is created.
Select the DNS Zone mode and enable SASL_SSL when you create the instance. Existing instances cannot be changed from an unencrypted listener to SASL_SSL.

​
Use an AutoMQ Managed Public DNS Zone

  1. When creating the instance, select Public DNS Zone and the AutoMQ managed mode.
  2. Enable the SASL_SSL listener and configure SASL authentication.
  3. Do not upload user-managed server certificate files. AutoMQ provisions and renews the server certificate.
  4. Create an ACL user and grant the required resource permissions.
Because the server certificate is issued by a public certificate authority, Kafka clients normally use the trust anchors supplied by the operating system or Java runtime. Do not configure a custom truststore unless your organization requires one.

​
Use a customer-managed Private DNS Zone

For a customer-managed Private DNS Zone, you must provide a CA certificate, Server Certificate, and Server Private Key. Use certificates issued by your organization’s certificate authority when available. If you need to create and maintain a private CA, use the following procedure as a reference.
The following commands create a private CA. Protect ca.key and server.key according to your organization’s key management requirements. Do not upload the CA private key to AutoMQ or distribute either private key to Kafka clients.

​
1. Create a private CA

Create ca.cnf. Replace the distinguished-name values before running the commands.
Generate the CA private key and CA certificate:

​
2. Issue the Server Certificate

Create server.cnf. The Subject Alternative Name (SAN) must cover the AutoMQ private endpoint names associated with the Private DNS Zone. Use the exact DNS name or wildcard required by the instance endpoint. Do not rely on the Common Name for hostname verification.
Generate the Server Private Key and certificate signing request (CSR), and then sign the CSR with the private CA:
Verify the certificate SAN and validity period before uploading it:

​
3. Configure AutoMQ

  1. When creating the instance, select the customer-managed Private DNS Zone and enable the SASL_SSL listener.
  2. Upload ca.crt as the Server CA certificate, server.crt as the Server Certificate, and server.key as the Private Key.
  3. Create an ACL user and grant only the Topic and Consumer Group permissions required by the application.

​
4. Configure a Kafka client

Import ca.crt into the client truststore when the client runtime does not already trust the private CA:

​
Certificate expiration responsibility

  • AutoMQ Managed Public DNS Zone: AutoMQ monitors and renews the server certificate. You do not rotate the server certificate.
  • Customer-managed Private DNS Zone: You are responsible for monitoring and rotating the server CA and certificate before expiration. Use kafka_stream_cert_expiry_timestamp_milliseconds and kafka_stream_cert_days_remaining to monitor the installed server certificate. For collection methods, see Monitoring and Alerting with Prometheus.