// Module included in the following assemblies:
//
// assembly-security.adoc

[id='certificates-{context}']
= Certificates

Each {ProductName} component needs its own private keys and public key certificates in order to support encryption.
All component certificates are signed by a Certification Authority (CA) called _cluster CA_, while the _clients CA_, is used to sign the certificates for the Kafka clients.
The CAs themselves use self-signed certificates.

All of the generated certificates are saved as `Secrets` in the Kubernetes cluster, named as follows:

`_cluster-name_-cluster-ca`::
Contains the private and public keys of the cluster CA which is used for signing server certificates for the Kafka and {ProductName} components (Kafka brokers, ZooKeeper nodes, and so on).
`_cluster-name_-cluster-ca-cert`::
Contains only the public key of the cluster CA which is used by Kafka clients to verify the identity of the Kafka brokers they are connecting to (TLS server authentication).
`_cluster-name_-clients-ca`::
Contains private and public keys of the clients CA which is used for TLS client authentication of Kafka clients when connecting to Kafka brokers.
`_cluster-name_-clients-ca-cert`::
Contains only the public key of the client CA which is used by the Kafka brokers to verify the identity of Kafka clients when TLS client authentication is used.
`_cluster-name_-kafka-brokers`::
Contains all Kafka broker private and public keys (certificates signed with the cluster CA).
`_cluster-name_-zookeeper-nodes`::
Contains all ZooKeeper node private and public keys (certificates signed with the cluster CA).
`_cluster-name_-topic-operator-certs`::
Contains the private and public keys (certificates signed with the cluster CA) used for encrypting communication between the Topic Operator and Kafka or ZooKeeper.

All keys are 2048 bits in size and are valid for 365 days from initial generation.

NOTE: Certificate rotation is not currently supported.
