# SSL Error when trying to connect K2K to my cluster

**URL:** <https://ask.lenses.io/t/ssl-error-when-trying-to-connect-k2k-to-my-cluster/429>\
**Category:** K2K\
**Created:** [September 5, 2025, 8:47am UTC](https://ask.lenses.io/t/ssl-error-when-trying-to-connect-k2k-to-my-cluster/429 "2025-09-05T08:47:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kafkaesque](https://avatars.discourse-cdn.com/v4/letter/k/85f322/32.png) [@kafkaesque](https://ask.lenses.io/u/kafkaesque)\
**Post date:** [September 5, 2025, 8:47am UTC](https://ask.lenses.io/t/ssl-error-when-trying-to-connect-k2k-to-my-cluster/429/1 "2025-09-05T08:47:26Z")

</div>

Anyone with some SSL experience available to help me out troubleshoot an issue with some K2K connectivity??  
I’m getting a very expressive:

```auto
Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

```

Problem seems to be that my self signed root certificate is not used when validating the certificate chain.  
The truststore has a certificate inside though and the password is correct (error is different if it’s wrong)

---

<div class="post-metadata">

**Author:** ![Carlos\_Teixeira](https://dub1.discourse-cdn.com/flex017/user_avatar/ask.lenses.io/carlos_teixeira/32/198_2.png) [@Carlos\_Teixeira](https://ask.lenses.io/u/Carlos_Teixeira)\
**Post date:** [September 5, 2025, 11:01am UTC](https://ask.lenses.io/t/ssl-error-when-trying-to-connect-k2k-to-my-cluster/429/2 "2025-09-05T11:01:33Z")

</div>

Hey,

It will be hard to pin point the exact reason why it’s failing. Likely there is some misconfiguration of your certificates.  
Some possible causes:

- Make sure you use `keytool` to importing things into a JKS file. Usually works better than just using openssl

- Use the same password for private key encryption password and keystore password. They seem to have to be the same.

- Make sure you’re enabling `-extensions v3_req` when signing the broker certificate using your root CA

- Make sure your certificates species `IP.0=127.0.0.1` under`[alt_names]`