// Module included in the following assemblies:
//
// assembly-security.adoc

[id='ref-alternative-subjects-certs-for-listeners-{context}']

= Alternative subjects in server certificates for Kafka listeners

In order to use TLS hostname verification with your own xref:kafka-listener-certificates-{context}[Kafka listener certificates], you must use the correct Subject Alternative Names (SANs) for each listener. The certificate SANs must specify hostnames for:

* All of the Kafka brokers in your cluster

* The Kafka cluster bootstrap service

You can use wildcard certificates if they are supported by your CA.

== TLS listener SAN examples

Use the following examples to help you specify hostnames of the SANs in your certificates for TLS listeners.

.Wildcards example

[source,shell,subs="+quotes,attributes+"]
----
//Kafka brokers
*._<cluster-name>_-kafka-brokers
*._<cluster-name>_-kafka-brokers._<namespace>_.svc

// Bootstrap service
_<cluster-name>_-kafka-bootstrap
_<cluster-name>_-kafka-bootstrap._<namespace>_.svc
----

.Non-wildcards example

[source,shell,subs="+quotes,attributes+"]
----
// Kafka brokers
_<cluster-name>_-kafka-0._<cluster-name>_-kafka-brokers
_<cluster-name>_-kafka-0._<cluster-name>_-kafka-brokers._<namespace>_.svc
_<cluster-name>_-kafka-1._<cluster-name>_-kafka-brokers
_<cluster-name>_-kafka-1._<cluster-name>_-kafka-brokers._<namespace>_.svc
# ...

// Bootstrap service
_<cluster-name>_-kafka-bootstrap
_<cluster-name>_-kafka-bootstrap._<namespace>_.svc
----

== External listener SAN examples

For external listeners which have TLS encryption enabled, the hostnames you need to specify in certificates depends on the external listener `type`.

.SANs for each type of external listener
[cols="2*",options="header",stripes="none",separator=¦]
|===

¦External listener type
¦In the SANs, specify...

m¦Route
¦Addresses of all Kafka broker `Routes` and the address of the bootstrap `Route`.

You can use a matching wildcard name.

m¦loadbalancer
¦Addresses of all Kafka broker `loadbalancers` and the bootstrap `loadbalancer` address.

You can use a matching wildcard name.

m¦NodePort
¦Addresses of all Kubernetes worker nodes that the Kafka broker pods might be scheduled to. 

You can use a matching wildcard name.

|===

.Additional resources

* xref:proc-installing-certs-per-listener-{context}[]
