// This assembly is included in the following assemblies:
//
// configuring/configuring.adoc

[id='security-{context}']
= Managing TLS certificates

[role="_abstract"]
Strimzi supports TLS for encrypted communication between Kafka and Strimzi components.

Strimzi establishes encrypted TLS connections for communication between the following components:

* Kafka brokers and ZooKeeper nodes
* Kafka brokers (interbroker communication) 
* ZooKeeper nodes (internodal communication)
* Strimzi operators and Kafka and ZooKeeper
* Cruise Control and Kafka
* Kafka Exporter and Kafka

Connections between clients and brokers use listeners that you must configure to use TLS-encrypted communication. 
You configure these listeners in the `Kafka` custom resource and each listener name and port number must be unique within the cluster. 
Communication between Kafka brokers and Kafka clients is encrypted according to how the `tls` property is configured for the listener.
For more information, see xref:deploy-client-access-str[].
 
The following diagram shows the connections for secure communication.   

.Kafka and ZooKeeper communication secured by TLS encryption
image::secure_communication.png[Secure Communication]

The ports shown in the diagram are used as follows:

Control plane listener (9090):: Connections between the Kafka controller and brokers use an internal control plane listener on port 9090, facilitating interbroker communication.
This listener is not accessible to Kafka clients.
Replication listener (9091):: Data replication between brokers, as well as internal connections from Strimzi operators, Cruise Control, and the Kafka Exporter, use the replication listener on port 9091.
This listener is not accessible to Kafka clients.
Listeners for client connections (9092 or higher):: 
For TLS-encrypted communication (through configuration of the listener), internal and external clients connect to Kafka brokers.
External clients (producers and consumers) connect to the Kafka brokers through the advertised listener port.    
ZooKeeper Port (2181):: ZooKeeper port for connection to Kafka.
ZooKeeper internodal communication port (2888):: ZooKeeper port for internodal communication between ZooKeeper nodes.
ZooKeeper leader election port (3888):: ZooKeeper port for leader election among ZooKeeper nodes in a ZooKeeper cluster.

IMPORTANT: When configuring listeners for client access to brokers, you can use port 9092 or higher (9093, 9094, and so on), but with a few exceptions.
The listeners cannot be configured to use the ports reserved for interbroker communication (9090 and 9091), Prometheus metrics (9404), and JMX (Java Management Extensions) monitoring (9999).

include::../../modules/security/con-certificate-authorities.adoc[leveloffset=+1]

include::../../modules/security/ref-certificates-and-secrets.adoc[leveloffset=+1]

include::../../modules/security/con-certificate-renewal.adoc[leveloffset=+1]

include::../../modules/security/proc-renewing-ca-certs-manually.adoc[leveloffset=+2]

include::../../modules/security/proc-recovering-expired-ca-certs.adoc[leveloffset=+2]

include::../../modules/security/proc-replacing-private-keys.adoc[leveloffset=+2]

include::../../modules/security/proc-configuring-internal-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::../../modules/security/proc-configuring-external-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

//user-supplied certs
include::assembly-using-your-own-certificates.adoc[leveloffset=+1]
