The parsing of the forbidden confgiuration options and their exceptions currently splits the string based on {{, }}. That is unfortunately very error prone because it mean that for example this:

ssl.enabled.protocols,cruise.control.metrics.topic.num.partitions

is not parsed as 2 different fields but as a single one. And as a result, none of these is really allowed to be configured when used in exceptions. As a result, the ssl.enabled.protocols option cannot be overridden now.