To allow for a gradual migration from non-secure to secure connections, the Kafka cluster must support both connection types simultaneously. The correct way to achieve this is by configuring multiple listeners on the brokers. By adding a new listener configured for SSL on a different port, the existing PLAINTEXT listener can remain active. This allows existing applications to continue connecting without interruption while new or updated applications can be configured to use the new, secure SSL listener. This approach provides the necessary transition period without causing a service outage for legacy clients.

A. Enable SSL on the current Listener, and do not enable mTLS.

Modifying the existing listener to use SSL would immediately break all current non-SSL client connections, violating the requirement for a gradual migration.

B. Modify the advertised listeners setting on brokers to use SSL.

The advertised.listeners setting tells clients how to connect. Changing this without adding a corresponding SSL listener will cause connection failures and does not enable coexistence.

D. Enable SSL on the current listener, and do not implement SSL on application side.

This is a technically non-functional scenario. If a broker listener requires SSL, a client application cannot connect to it without also being configured for SSL.

1. Confluent Documentation, "Encryption and Authentication with SSL for Apache Kafka": In the "Configuring Kafka Brokers" section, the documentation explicitly states how to configure multiple listeners. It provides an example: listeners=PLAINTEXT://kafka1:9092,SSL://kafka1:9093. The text clarifies, "This allows clients to connect to the broker using either plaintext or SSL," which is the exact requirement for the migration scenario.

Source: Confluent Documentation, Security > Encryption and Authentication with SSL for Apache Kafka > Configuring Kafka Brokers.

2. Apache Kafka Documentation, "Security": Section 3.3, "Configuring Kafka Brokers," describes the listeners configuration property. It specifies that this property is a "comma-separated list of listeners" and provides an example of configuring both PLAINTEXT and SSL listeners on different ports (listeners = PLAINTEXT://:9092,SSL://:9093), confirming this is the standard method for supporting multiple protocols.

Source: Apache Kafka Documentation, Section 3. Security > 3.3 Encryption and Authentication using SSL.