// Module included in the following assemblies:
//
// overview/assembly-security-overview.adoc

[id="security-configuration-encryption_{context}"]
= Encryption

Strimzi supports Transport Layer Security (TLS), a protocol for encrypted communication.

Communication is always encrypted for communication between:

* Kafka brokers
* ZooKeeper nodes
* Operators and Kafka brokers
* Operators and ZooKeeper nodes
* Kafka Exporter

You can also configure TLS encryption between Kafka brokers and clients.
TLS is specified for external clients when configuring an external listener for the Kafka broker.

Strimzi components and Kafka clients use digital certificates for encryption.
The Cluster Operator sets up certificates to enable encryption within the Kafka cluster.
You can provide your own server certificates, referred to as _Kafka listener certificates_,
for communication between Kafka clients and Kafka brokers, and inter-cluster communication.

Strimzi uses _Secrets_ to store the certificates and private keys required for mTLS in PEM and PKCS #12 format.

A TLS CA (certificate authority) issues certificates to authenticate the identity of a component.
Strimzi verifies the certificates for the components against the CA certificate.

* Strimzi components are verified against the _cluster CA_ CA
* Kafka clients are verified against the _clients CA_ CA
