Configuring Kafka

Last Updated : Oct 29, 2025 |

Procedure

  1. Open $KAFKA_HOME/config/server.properties file and change log.dirs to $KAFKA_HOME/kafka-store/kafka.
  2. Modify broker.id to unique number across all servers.

    For example, if broker.id on primary is 1 and aux server is 2, then the broker.id on external machine must be any valid positive number except 1 or 2.

  3. Update the hostname in listeners and advertised listeners to the hostname of the external server machine.
  4. Generate keyStore using below keytool command: keytool -genkeypair -keystore <keystore> -dname "CN=test, OU=<Organization Unit name>, O=<Organization name>" -keypass <keypwd> -storepass <storepass> -keyalg RSA -alias <alias_name> -ext SAN=dns:<DNS_NAME>,ip:<IP_ADDRESS>.

    For example: keytool -genkeypair -keystore pomKeyStore -dname "CN=test, OU=POM, O=Avaya" -keypass changeit -storepass changeit -keyalg RSA -alias externalkafkaserver -ext SAN=dns:test.abc.com,ip:127.0.0.1

  5. Verify the generated keystore.
  6. Provide the path of the keystore generated in step 4 in ssl.keystore.location of $KAFKA_HOME/config/server.properties.
  7. Export the generated server certificate from keystore using the following command keytool -export -alias <alias name> -storepass changeit -file <cert name> -keystore <keystore>.

    For example: keytool -export -alias externalkafkaserver -storepass changeit -file pim.crt -keystore pomKeyStore

  8. Verify the generated certificate.
  9. Import the certificate generated in step 7 to the pomTrustStore of the primary server using POM Trusted Certificates page.
    Note:

    Restart pomkafka on all POM servers after updating pomTrustStore.

  10. Copy the modified $POM_HOME/config/pomTrustStore of the primary POM server and paste it on external Kafka server and update ssl.truststore.location property in $KAFKA_HOME/config/server.properties.
  11. Change ssl.keystore.password, ssl.key.password, and ssl.truststore.password in $KAFKA_HOME/config/server.properties.
    Note:

    Set the password that is used while generating certificate.

  12. The following are the Kafka server configuration properties, highlighted in bold, that will get updated after the above configurations: 
    broker.id=3
num.network.threads=3
num.io.threads=8
socket.send.buffer.bytes=102400
socket.receive.buffer.bytes=102400
socket.request.max.bytes=104857600
log.dirs=<KAFKA_HOME>/kafka-store/kafka
num.partitions=1
num.recovery.threads.per.data.dir=1
offsets.topic.replication.factor=3
transaction.state.log.replication.factor=3
transaction.state.log.min.isr=1
log.retention.hours=72
log.segment.bytes=1073741824
log.retention.check.interval.ms=300000
zookeeper.connect=148.147.XX.XX:2182,148.147.XX.XX:2182,148.147.XX.XX:2182
zookeeper.connection.timeout.ms=30000
group.initial.rebalance.delay.ms=0
listeners=SSL://kafkaexternal:9093
advertised.listeners=SSL://kafkaexternal:9093
ssl.keystore.location=/opt/config/pomKeyStore
ssl.keystore.password=changeit
ssl.key.password=changeit
ssl.truststore.location=/opt/config/pomTrustStore
ssl.truststore.password=changeit
ssl.client.auth=required
ssl.keystore.type=JKS
ssl.truststore.type=JKS
ssl.enabled.protocols=TLSv1.2
ssl.cipher.suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_EMPTY_RENEGOTIATION_INFO_SCSVsecurity.inter.broker.protocol=SSL
default.replication.factor=3
  13. Start Kafka using the following command:

    $KAFKA_HOME/bin/kafka-server-start.sh $KAFKA_HOME/config/server.properties