$ ./kafkacat -b $KAFKA_BROKER_HOST:$KAFKA_BROKER_PORT \
> -t my_topic \
> -s value=avro \
> -r https://$KAFKA_API_KEY:$KAFKA_API_SECRET@$KAFKA_SCHEMA_REGISTRY_HOST:$KAFKA_SCHEMA_REGISTRY_PORT \
> -X security.protocol=SASL_SSL \
> -X sasl.mechanisms=PLAIN \
> -X sasl.username="$KAFKA_API_KEY" -X sasl.password="$KAFKA_API_SECRET" \
> -X ssl.keystore.location=$KAFKA_KEYSTORE_P12_LOCATION \
> -X ssl.keystore.password=$KAFKA_KEYSTORE_PASSPHRASE \
> -X ssl.key.password=$KAFKA_KEY_PASSPHRASE \
> -X enable.ssl.certificate.verification=false \
> -C \
> -o beginning
% ERROR: Failed to format message in my_topic [0] at offset 2: Avro/Schema-registry message deserialization: REST request failed (code -1): HTTP request failed: SSL peer certificate or SSH remote key was not OK : terminating

export SCHEMA_REGISTRY_OPTS="-Djavax.net.ssl.keyStore=$KAFKA_KEYSTORE_LOCATION -Djavax.net.ssl.trustStore=$KAFKA_TRUSTSTORE_LOCATION -Djavax.net.ssl.keyStorePassword=$KAFKA_KEYSTORE_PASSPHRASE -Djavax.net.ssl.trustStorePassword=$KAFKA_TRUSTSTORE_PASSPHRASE"

./kafka-avro-console-consumer
...
--property schema.registry.url=https://$KAFKA_SCHEMA_REGISTRY_HOST:$KAFKA_SCHEMA_REGISTRY_PORT \
--property schema.registry.basic.auth.user.info="$KAFKA_API_KEY:$KAFKA_API_SECRET" \
--property basic.auth.credentials.source=USER_INFO \
...