// Module included in the following assemblies:
//
// assembly-security.adoc

[id='installing-your-own-ca-certificates-{context}']
= Installing your own CA certificates

This procedure describes how to install your own CA certificates and private keys instead of using CA certificates and private keys generated by the Cluster Operator.

.Prerequisites

* The Cluster Operator is running.
* A Kafka cluster is not yet deployed.
* Your own X.509 certificates and keys in PEM format for the cluster CA or clients CA.
+
** If you want to use a cluster or clients CA which is not a Root CA, you have to include the whole chain in the certificate file.
The chain should be in the following order:
+
1. The cluster or clients CA
2. One or more intermediate CAs
3. The root CA
+
** All CAs in the chain should be configured as a CA in the X509v3 Basic Constraints.

.Procedure

. Put your CA certificate in the corresponding `Secret` (`_<cluster>_-cluster-ca-cert` for the cluster CA or `_<cluster>_-clients-ca-cert` for the clients CA):
+
Run the following commands:
+
[source,shell,subs="+quotes"]
----
# Delete any existing secret (ignore "Not Exists" errors)
kubectl delete secret _<ca-cert-secret>_
# Create and label the new secret
kubectl create secret generic _<ca-cert-secret>_ --from-file=ca.crt=_<ca-cert-file>_
----
+

. Put your CA key in the corresponding `Secret` (`_<cluster>_-cluster-ca` for the cluster CA or `_<cluster>_-clients-ca` for the clients CA):
+
[source,shell,subs="+quotes"]
----
# Delete the existing secret
kubectl delete secret _<ca-key-secret>_
# Create the new one
kubectl create secret generic _<ca-key-secret>_ --from-file=ca.key=_<ca-key-file>_
----

. Label both `Secrets` with the labels `strimzi.io/kind=Kafka` and `strimzi.io/cluster=_<my-cluster>_`:
+
[source,shell,subs="+quotes"]
----
kubectl label secret _<ca-cert-secret>_ strimzi.io/kind=Kafka strimzi.io/cluster=_<my-cluster>_
kubectl label secret _<ca-key-secret>_ strimzi.io/kind=Kafka strimzi.io/cluster=_<my-cluster>_
----

. Create the `Kafka` resource for your cluster, configuring either the `Kafka.spec.clusterCa` or the `Kafka.spec.clientsCa` object to _not_ use generated CAs:
+
.Example fragment `Kafka` resource configuring the cluster CA to use certificates you supply for yourself
[source,yaml,subs="attributes"]
----
kind: Kafka
version: {KafkaApiVersion}
spec:
  # ...
  clusterCa:
    generateCertificateAuthority: false
----

.Additional resources

* For the procedure for renewing CA certificates you have previously installed, see xref:renewing-your-own-ca-certificates-{context}[].

* xref:proc-installing-certs-per-listener-{context}[].
