// Module included in the following assemblies:
//
// assembly-security.adoc

[id='installing-your-own-ca-certificates-{context}']
= Installing your own CA certificates

This procedure describes how to install your own CA certificates and keys instead of using the CA certificates and private keys generated by the Cluster Operator.

You can use this procedure to install your own cluster or client CA certificates.

The procedure describes renewal of CA certificates in PEM format.
You can also use certificates in PKCS #12 format.

.Prerequisites

* The Cluster Operator is running.
* A Kafka cluster is not yet deployed.
* Your own X.509 certificates and keys in PEM format for the cluster CA or clients CA.
+
** If you want to use a cluster or clients CA which is not a Root CA, you have to include the whole chain in the certificate file.
The chain should be in the following order:
+
1. The cluster or clients CA
2. One or more intermediate CAs
3. The root CA
+
** All CAs in the chain should be configured as a CA in the X509v3 Basic Constraints.

.Procedure

. Put your CA certificate in the corresponding `Secret`.

.. Delete the existing secret:
+
[source,shell,subs="+quotes"]
kubectl delete secret _CA-CERTIFICATE-SECRET_
+
_CA-CERTIFICATE-SECRET_ is the name of the `Secret`,  which is `_CLUSTER-NAME_-cluster-ca-cert` for the cluster CA certificate and `_CLUSTER-NAME_-clients-ca-cert` for the clients CA certificate.
+
Ignore any "Not Exists" errors.

.. Create and label the new secret
+
[source,shell,subs="+quotes"]
kubectl create secret generic _CA-CERTIFICATE-SECRET_ --from-file=ca.crt=_CA-CERTIFICATE-FILENAME_

. Put your CA key in the corresponding `Secret`.
+
.. Delete the existing secret:
+
[source,shell,subs="+quotes"]
kubectl delete secret _CA-KEY-SECRET_
+
_CA-KEY-SECRET_ is the name of CA key, which is `_CLUSTER-NAME_-cluster-ca` for the cluster CA key and `_CLUSTER-NAME_-clients-ca` for the clients CA key.

.. Create the new secret:
+
[source,shell,subs="+quotes"]
kubectl create secret generic _CA-KEY-SECRET_ --from-file=ca.key=_CA-KEY-SECRET-FILENAME_

. Label the secrets with the labels `strimzi.io/kind=Kafka` and `strimzi.io/cluster=_CLUSTER-NAME_`:
+
[source,shell,subs="+quotes"]
----
kubectl label secret _CA-CERTIFICATE-SECRET_ strimzi.io/kind=Kafka strimzi.io/cluster=_CLUSTER-NAME_
kubectl label secret _CA-KEY-SECRET_ strimzi.io/kind=Kafka strimzi.io/cluster=_CLUSTER-NAME_
----

. Create the `Kafka` resource for your cluster, configuring either the `Kafka.spec.clusterCa` or the `Kafka.spec.clientsCa` object to _not_ use generated CAs:
+
.Example fragment `Kafka` resource configuring the cluster CA to use certificates you supply for yourself
[source,yaml,subs="attributes"]
----
kind: Kafka
version: {KafkaApiVersion}
spec:
  # ...
  clusterCa:
    generateCertificateAuthority: false
----

.Additional resources

* To renew CA certificates you have previously installed, see xref:renewing-your-own-ca-certificates-{context}[].

* xref:proc-installing-certs-per-listener-{context}[].
