// Module included in the following assemblies:
//
// assembly-security.adoc

[id='proc-installing-certs-per-listener-{context}']
= Providing your own Kafka listener certificates

This procedure shows how to configure a listener to use your own private key and server certificate, called a xref:kafka-listener-certificates-{context}[Kafka listener certificate].

Your client applications should use the CA public key as a trusted certificate in order to verify the identity of the Kafka broker.

.Prerequisites

* A Kubernetes cluster.
* The Cluster Operator is running.
* For each listener, a compatible server certificate signed by an external CA.
** Provide an X.509 certificate in PEM format.
** Specify the correct Subject Alternative Names (SANs) for each listener.
For more information, see xref:ref-alternative-subjects-certs-for-listeners-{context}[].
** You can provide a certificate that includes the whole CA chain in the certificate file.

.Procedure

. Create a `Secret` containing your private key and server certificate:
+
[source,shell,subs="+quotes"]
----
kubectl create secret generic _my-secret_ --from-file=_my-listener-key.key_ --from-file=_my-listener-certificate.crt_
----

. Edit the `Kafka` resource for your cluster. Configure the listener to use your `Secret`, certificate file, and private key file in the `configuration.brokerCertChainAndKey` property.
+
.Example configuration for a `loadbalancer` external listener with TLS encryption enabled
[source,yaml,subs="attributes+"]
----
# ...
listeners:
  - name: plain
    port: 9092
    type: internal
    tls: false
  - name: external
    port: 9094
    type: loadbalancer
    tls: true
    authentication:
      type: tls
    configuration:
      brokerCertChainAndKey:
        secretName: my-secret
        certificate: my-listener-certificate.crt
        key: my-listener-key.key
# ...
----
+
.Example configuration for a TLS listener
[source,yaml,subs="attributes+"]
----
# ...
listeners:
  - name: plain
    port: 9092
    type: internal
    tls: false
  - name: tls
    port: 9093
    type: internal
    tls: true
    authentication:
      type: tls
    configuration:
      brokerCertChainAndKey:
        secretName: my-secret
        certificate: my-listener-certificate.crt
        key: my-listener-key.key
# ...
----

. Apply the new configuration to create or update the resource:
+
[source,shell,subs="+quotes"]
----
kubectl apply -f _kafka.yaml_
----
+
The Cluster Operator starts a rolling update of the Kafka cluster, which updates the configuration of the listeners.
+
NOTE: A rolling update is also started if you update a Kafka listener certificate in a `Secret` that is already used by a TLS or external listener.

.Additional resources

* xref:ref-alternative-subjects-certs-for-listeners-{context}[Alternative subjects in server certificates for Kafka listeners]
* xref:type-GenericKafkaListener-reference[`GenericKafkaListener` schema reference]
* xref:kafka-listener-certificates-{context}[Kafka listener certificates]
