// Module included in the following assemblies:
//
// assembly-security.adoc

[id='kafka-listener-certificates-{context}']

= Kafka listener certificates

You can provide your own server certificates and private keys for any listener with TLS encryption enabled.
These user-provided certificates are called _Kafka listener certificates_.

Providing Kafka listener certificates allows you to leverage existing security infrastructure, such as your organization's private CA or a public CA.
Kafka clients will need to trust the CA which was used to sign the listener certificate.

You must manually renew Kafka listener certificates when needed.
