// Module included in the following assemblies:
//
// assembly-security.adoc

[id='certificate-authorities-{context}']
= Internal cluster CA and clients CA

[role="_abstract"]
To support encryption, each Strimzi component needs its own private keys and public key certificates.
All component certificates are signed by an internal CA (certificate authority) called the _cluster CA_.

CA (Certificate Authority) certificates are generated by the Cluster Operator to verify the identities of components and clients.

Similarly, each Kafka client application connecting to Strimzi using mTLS needs to use private keys and certificates.
A second internal CA, named the _clients CA_, is used to sign certificates for the Kafka clients.

Both the cluster CA and clients CA have a self-signed public key certificate.

Kafka brokers are configured to trust certificates signed by either the cluster CA or clients CA.
Components that clients do not need to connect to, such as ZooKeeper, only trust certificates signed by the cluster CA.
Unless TLS encryption for external listeners is disabled, client applications must trust certificates signed by the cluster CA.
This is also true for client applications that perform mTLS authentication. 

By default, Strimzi automatically generates and renews CA certificates issued by the cluster CA or clients CA.
You can configure the management of these CA certificates using `Kafka.spec.clusterCa` and `Kafka.spec.clientsCa` properties.

NOTE: If you don't want to use the CAs generated by the Cluster Operator, you can xref:installing-your-own-ca-certificates-str[install your own cluster and clients CA certificates].
Any certificates you provide are not renewed by the Cluster Operator.
