provides TLS related cipher suites and algorithms in Pulsar. If you need FIPS version of Bouncy Castle Provider, please reference .

Client certificates are generated using the certificate authority. Server certificates are also generated with the same certificate authority.

The biggest difference between client certs and server certs is that the common name for the client certificate is the role token which that client is authenticated as.

First, you need to enter the following command to generate the key :

$ openssl pkcs8 -topk8 -inform PEM -outform PEM \
      -in admin.key.pem -out admin.key-pk8.pem -nocrypt

接下来，输入下面的命令来生成证书请求。 When you are asked for a common name, enter the role token that you want this key pair to authenticate a client as.

$ openssl req -config openssl.cnf \
      -key admin.key.pem -new -sha256 -out admin.csr.pem

然后输入下面的命令来与证书权威签约。 Note that the client certs uses the usr_cert extension, which allows the cert to be used for client authentication.

你可以从此命令获得证书、 admin.cert.pem和一个密钥。 admin.key-pk8.pem 使用 ca.cert. em， 客户可以使用此证书和此密钥向 broker 和 proxy 进行身份验证，作为 管理员

$ cd /etc/pki/tls/misc/CA $ ./CA -newca

生成 `cakey.pem`。
## 在 broker 上启用 TLS 认证
要配置 broker 来验证客户端，请在 `broker.conf`中添加以下参数，和 [配置一起启用tls transport](security-tls-transport.md#broker-configuration)：
```properties
# Configuration to enable authentication
authenticationEnabled=true
# operations and publish/consume from all topics
superUserRoles=admin
brokerClientTlsEnabled=true
brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
brokerClientAuthenticationParameters=tlsCertFile:/path/my-ca/admin.cert.pem,tlsKeyFile:/path/my-ca/admin.key-pk8.pem
brokerClientTrustCertsFilePath=/path/my-ca/certs/ca.cert.pem

要配置 proxy 服务器来验证客户端，请在 代理.conf的配置中加上 来启用tls transport:

代理服务器应该有自己的客户端密钥对。 你需要在 broker 的 代理角色 中配置此密钥对的角色标记。 详情请访问 。

# For clients connecting to the proxy
authenticationEnabled=true
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderTls
# For the proxy to connect to brokers
brokerClientAuthenticationPlugin=org.apache.pulsar.client.impl.auth.AuthenticationTls
brokerClientAuthenticationParameters=tlsCertFile:/path/to/proxy.cert.pem,tlsKeyFile:/path/to/proxy.key-pk8.pem

When you use TLS authentication, client connects via TLS transport. You need to configure the client to use https:// and 8443 port for the web service URL, pulsar+ssl:// and 6651 port for the broker service URL.

命令行工具

你需要添加以下参数到该文件以使用 Pulsar 的 CLI 工具使用 TLS 身份验证：

import org.apache.pulsar.client.api.PulsarClient;
PulsarClient client = PulsarClient.builder()
    .serviceUrl("pulsar+ssl://broker.example.com:6651/")
    .enableTls(true)
                    "tlsCertFile:/path/to/my-role.cert.pem,tlsKeyFile:/path/to/my-role.key-pk8.pem")
    .build();

Python client

from pulsar import Client, AuthenticationTLS
auth = AuthenticationTLS("/path/to/my-role.cert.pem", "/path/to/my-role.key-pk8.pem")
client = Client("pulsar+ssl://broker.example.com:6651/",
                tls_trust_certs_file_path="/path/to/ca.cert.pem",
                tls_allow_insecure_connection=False,
                authentication=auth)

Node.js 客户端

const Pulsar = require('pulsar-client');
(async () => {
  const auth = new Pulsar.AuthenticationTls({
    certificatePath: '/path/to/my-role.cert.pem',
    privateKeyPath: '/path/to/my-role.key-pk8.pem',
  });
  const client = new Pulsar.Client({
    serviceUrl: 'pulsar+ssl://broker.example.com:6651/',
    authentication: auth,
    tlsTrustCertsFilePath: '/path/to/ca.cert.pem',
  });