// This assembly is included in the following assemblies:
//
// configuring/configuring.adoc

[id='security-{context}']
= Managing TLS certificates

[role="_abstract"]
Strimzi supports TLS for encrypted communication between Kafka and Strimzi components.

Strimzi establishes encrypted TLS connections for communication between the following components:

* Kafka brokers and ZooKeeper nodes
* Kafka brokers (interbroker communication) 
* ZooKeeper nodes (internodal communication)
* Strimzi operators and Kafka and ZooKeeper
* Cruise Control and Kafka
* Kafka Exporter and Kafka

Connections between Kafka brokers use an internal control plane listener on port 9090. 
Connections to replicate data between brokers, and internal connections from the Strimzi operators, Cruise Control, or the Kafka Exporter, use a replication listener on port 9091. 
These listeners are not accessible to Kafka clients.

The Cluster Operator automatically sets up and renews TLS certificates to enable encryption and authentication within a cluster.
It also sets up other TLS certificates if you want to enable encryption or mTLS authentication between Kafka brokers and clients.
Communication between Kafka brokers and Kafka clients is encrypted according to how the cluster is configured using the `tls` property for `spec.kafka.listeners` in the `Kafka` custom resource.

CA (certificate authority) certificates are generated by the Cluster Operator to verify the identities of components and clients.
If you don't want to use the CAs generated by the Cluster Operator, you can xref:installing-your-own-ca-certificates-str[install your own cluster and clients CA certificates].

You can also provide xref:proc-installing-certs-per-listener-str[_Kafka listener certificates_] for TLS listeners or external listeners that have TLS encryption enabled.
Use Kafka listener certificates to incorporate the security infrastructure you already have in place.

NOTE: Any certificates you provide are not renewed by the Cluster Operator.

.Kafka and ZooKeeper communication secured by TLS encryption
image::secure_communication.png[Secure Communication]

include::../../modules/security/con-certificate-authorities.adoc[leveloffset=+1]

include::../../modules/security/ref-certificates-and-secrets.adoc[leveloffset=+1]

include::../../modules/security/con-certificate-renewal.adoc[leveloffset=+1]

include::../../modules/security/proc-renewing-ca-certs-manually.adoc[leveloffset=+2]

include::../../modules/security/proc-recovering-expired-ca-certs.adoc[leveloffset=+2]

include::../../modules/security/proc-replacing-private-keys.adoc[leveloffset=+2]

include::../../modules/security/proc-configuring-internal-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::../../modules/security/proc-configuring-external-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

//user-supplied certs
include::assembly-using-your-own-certificates.adoc[leveloffset=+1]
