// This assembly is included in the following assemblies:
//
// security/assembly-security.adoc

[id='security-using-your-own-certificates-{context}']
= Using your own CA certificates and private keys

[role="_abstract"]
Install and use your own CA certificates and private keys instead of using the defaults generated by the Cluster Operator.
You can replace the cluster and clients CA certificates and private keys.

You can switch to using your own CA certificates and private keys in the following ways:

* Install your own CA certificates and private keys before deploying your Kafka cluster
* Replace the default CA certificates and private keys with your own after deploying a Kafka cluster

The steps to replace the default CA certificates and private keys after deploying a Kafka cluster are the same as those used to renew your own CA certificates and private keys.

If you use your own certificates, they won't be renewed automatically. 
You need to renew the CA certificates and private keys before they expire.

Renewal options:

* Renew the CA certificates only
* Renew CA certificates and private keys (or replace the defaults)

include::../../modules/security/proc-installing-your-own-ca-certificates.adoc[leveloffset=+1]

include::../../modules/security/proc-renewing-your-own-ca-certificates.adoc[leveloffset=+1]

include::../../modules/security/proc-replacing-your-own-private-keys.adoc[leveloffset=+1]