1:在kafka的每個 broker機器上 生產(chǎn)證書文件

keytool -genkeypair -keyalg RSA -validity 3650 -keystore ~/.keystore -alias ${keyname}

2:導出證書文件

keytool -exportcert -keystore ~/.keystore -alias ${keyname} -file ${filename}.cert

3:在部署jmxtrans的機器上導入全部 broker上的證書文件

keytool -importcert -keystore ~/.truststore -alias ${keyname} -file ${filename}.cert

4:在kafka的每個broker上修改bin/kafka-server-start.sh文件，在exec 之前加入

export KAFKA_JMX_OPTS="-Dcom.sun.management.jmxremote=true
-Dcom.sun.management.jmxremote.authenticate=false
-Dcom.sun.management.jmxremote.ssl=true
-Dcom.sun.management.jmxremote.port=9999
-Dcom.sun.management.jmxremote.rmi.port=9999
-Dcom.sun.management.jmxremote.registry.ssl=true
-Djavax.net.ssl.keyStore=/root/.keystore
-Djavax.net.ssl.keyStorePassword=${keystorepassword}
-Djavax.net.ssl.trustStore=/root/.truststore
-Djavax.net.ssl.trustStorePassword=${truststroepassword}
"

5:重啟kafka集群

bin/kafka-server-start.sh -daemon config/server.properties

6:在jmxtrans機器上，配置文件中添加ssl=true

{
"servers":[
{
"port":"12345",
"host":"monitoredhost",
"ssl":true,
"queries": [ ... ]
}
]
}

7:啟動jmxtrans.sh 腳本時，加入jvm參數(shù)

-Djavax.net.ssl.trustStore=/root/.truststroe
-Djavax.net.ssl.trustStorePassword=${truststorepassword}