// Module included in the following assemblies:
//
// assembly-security.adoc

[id='certificate-authorities-{context}']
= Internal cluster CA and clients CA

[role="_abstract"]
To support encryption, each Strimzi component needs its own private keys and public key certificates.
All component certificates are signed by an internal CA (certificate authority) called the _cluster CA_.

Similarly, each Kafka client application connecting to Strimzi using mTLS needs to use private keys and certificates.
A second internal CA, named the _clients CA_, is used to sign certificates for the Kafka clients.

Both the cluster CA and clients CA have a self-signed public key certificate.

Kafka brokers are configured to trust certificates signed by either the cluster CA or clients CA.
Components that clients do not need to connect to, such as ZooKeeper, only trust certificates signed by the cluster CA.
Unless TLS encryption for external listeners is disabled, client applications must trust certificates signed by the cluster CA.
This is also true for client applications that perform mTLS authentication. 

By default, Strimzi automatically generates and renews CA certificates issued by the cluster CA or clients CA.
You can configure the management of these CA certificates using `Kafka.spec.clusterCa` and `Kafka.spec.clientsCa` properties.

NOTE: If you are xref:installing-your-own-ca-certificates-{context}[providing your own CA certificates], you must renew them before they expire.
