// Module included in the following assemblies:
//
// assembly-configuring-kafka-listeners.adoc

[id='con-mutual-tls-authentication-{context}']
= Mutual TLS authentication

Mutual TLS authentication is always used for the communication between Kafka brokers and ZooKeeper pods.

Mutual authentication or two-way authentication is when both the server and the client present certificates. {ProductName} can configure Kafka to use TLS (Transport Layer Security) to provide encrypted communication between Kafka brokers and clients either with or without mutual authentication. When you configure mutual authentication, the broker authenticates the client and the client authenticates the broker.

NOTE: TLS authentication is more commonly one-way, with one party authenticating the identity of another. For example, when HTTPS is used between a web browser and a web server, the server obtains proof of the identity of the browser.

== When to use mutual TLS authentication for clients

Mutual TLS authentication is recommended for authenticating Kafka clients when:

* The client supports authentication using mutual TLS authentication
* It is necessary to use the TLS certificates rather than passwords
* You can reconfigure and restart client applications periodically so that they do not use expired certificates.
