// This assembly is included in the following assemblies:
//
// configuring/configuring.adoc

[id='security-{context}']
= Managing TLS certificates

[role="_abstract"]
Strimzi supports TLS for encrypted communication between Kafka and Strimzi components.

Communication is always encrypted between the following components:

* Communication between Kafka and ZooKeeper
* Interbroker communication between Kafka brokers
* Internodal communication between ZooKeeper nodes
* Strimzi operator communication with Kafka brokers and ZooKeeper nodes

Communication between Kafka clients and Kafka brokers is encrypted according to how the cluster is configured.
For the Kafka and Strimzi components, TLS certificates are also used for authentication.

The Cluster Operator automatically sets up and renews TLS certificates to enable encryption and authentication within your cluster.
It also sets up other TLS certificates if you want to enable encryption or TLS authentication between Kafka brokers and clients.

Certificate Authority (CA) certificates are generated by the Cluster Operator to verify the identities of components and clients.
If you don't want to use the CAs generated by the Cluster Operator, you can xref:installing-your-own-ca-certificates-str[install your own cluster and client CA certificates].

You can also xref:kafka-listener-certificates-str[provide _Kafka listener certificates_] for TLS listeners or external listeners that have TLS encryption enabled.
Use Kafka listener certificates to incorporate the security infrastructure you already have in place.

NOTE: Any certificates you provide are not renewed by the Cluster Operator.

.Example architecture of the communication secured by TLS
image::secure_communication.png[Secure Communication]

include::modules/con-certificate-authorities.adoc[leveloffset=+1]

include::modules/proc-installing-your-own-ca-certificates.adoc[leveloffset=+2]

include::modules/ref-certificates-and-secrets.adoc[leveloffset=+1]

include::modules/con-certificate-renewal.adoc[leveloffset=+1]

include::modules/proc-renewing-ca-certs-manually.adoc[leveloffset=+2]

include::modules/proc-replacing-private-keys.adoc[leveloffset=+2]

include::modules/proc-renewing-your-own-ca-certificates.adoc[leveloffset=+2]

include::modules/proc-replacing-your-own-private-keys.adoc[leveloffset=+2]

include::modules/con-tls-connections.adoc[leveloffset=+1]

include::modules/proc-configuring-internal-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::modules/proc-configuring-external-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::modules/con-kafka-listener-certificates.adoc[leveloffset=+1]

include::modules/proc-installing-certs-per-listener.adoc[leveloffset=+2]

include::modules/ref-alternative-subjects-certs-for-listeners.adoc[leveloffset=+2]
