Home icon

Migrating TLS Clients managed by third-party Certificate Authorities from self-managed Apache Kafka to Amazon MSK

Big Data Blog

This article explains how to migrate TLS clients from self-managed Apache Kafka to Amazon MSK while reusing existing third-party CA-signed certificates without reissuance.

  • Create intermediate CA certificate from existing third-party CA infrastructure
  • Import intermediate certificate into AWS Certificate Manager as Private CA
  • Configure Amazon MSK cluster to use the imported ACM Private CA
  • Establish trust through common root CA; certificate chain validates seamlessly
  • Detailed implementation steps include OpenSSL setup, CSR signing, and certificate import
  • Test client connection using Kafka CLI with TLS properties file
  • Enable Java SSL debug mode for troubleshooting certificate handshake issues

This solution enables accelerated migration to Amazon MSK by maintaining existing security architecture and mTLS implementation without certificate reissuance overhead.

Go to article

The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.

Related articles

Apr 20
2026
Migrate third-party and self-managed Apache Kafka clusters to Amazon MSK Express brokers with Amazon MSK Replicator
Mar 16
2026
Securely connect Kafka clients running outside AWS to Amazon MSK with IAM Roles Anywhere
Feb 21
2025
Amazon MSK adds support for Apache Kafka version 3.8
May 29
2024
Amazon MSK adds support for Apache Kafka version 3.7

The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.