// Module included in the following assemblies:
//
// assembly-security.adoc

[id='installing-your-own-ca-certificates-{context}']
= Installing your own CA certificates

This procedure describes how to install your own CA certificates and private keys instead of using CA certificates and private keys generated by the Cluster Operator.

.Prerequisites

* The Cluster Operator is running.
* A `Kafka` resource within {ProductPlatformName}
* Your own X.509 certificates and keys in PEM format for the cluster CA or clisters CA. For example, these could be generated by `openssl`, using a command such as:
+
[source,shell,subs="+quotes"]
openssl req -x509 -new -days _<validity>_ --nodes -out ca.crt -keyout ca.key


.Procedure

. Edit the `Kafka` resource for your cluster, configuring either the `Kafka.spec.clusterCa` or the `Kafka.spec.clientsCa` object to _not_ use generated CAs:
+
.Example fragment `Kafka` resource configuring the cluster CA to use certificates you supply for yourself
[source,yaml]
----
kind: Kafka
version: v1alpha1
spec:
  # ...
  clusterCa:
    generateCertificateAuthority: false
----
+
This will prevent the Cluster Operator from generating a new CA. It will not disable an existing generated CA.

. Put your CA certificate in the corresponding `Secret` (`_<cluster>_-cluster-ca-cert` for the cluster CA or `_<cluster>_-client-ca-cert` for the clients CA):
ifdef::Kubernetes[]
+
On {KubernetesName}, run the following commands:
+
[source,shell,subs="+quotes"]
----
# Delete any existing secret (ignore "Not Exists" errors)
kubectl delete secret _<ca-cert-secret>_
# Create the new one
kubectl create secret generic _<ca-cert-secret>_ --from-file=ca.crt=_<ca-cert-file>_
----
endif::Kubernetes[]
+
On {OpenShiftName}, run the following commands:
+
[source,shell,subs="+quotes"]
----
# Delete any existing secret (ignore "Not Exists" errors)
oc delete secret _<ca-cert-secret>_
# Create the new one
oc create secret generic _<ca-cert-secret>_ --from-file=ca.crt=_<ca-cert-file>_
----

. Put your CA key in the corresponding `Secret` (`_<cluster>_-cluster-ca` for the cluster CA or `_<cluster>_-client-ca` for the clients CA)
ifdef::Kubernetes[]
+
On {KubernetesName}, run the following commands:
+
[source,shell,subs="+quotes"]
----
# Delete the existing secret
kubectl delete secret _<ca-key-secret>_
# Create the new one
kubectl create secret generic _<ca-key-secret>_ --from-file=ca.key=_<ca-key-file>_
----
endif::Kubernetes[]
+
On {OpenShiftName}, run the following commands:
+
[source,shell,subs="+quotes"]
----
# Delete the existing secret
oc delete secret _<ca-key-secret>_
# Create the new one
oc create secret generic _<ca-key-secret>_ --from-file=ca.key=_<ca-key-file>_
----

.Additional resources

* For the procedure for renewing CA certificates you have previousy installed, see xref:renewing-your-own-ca-certificates-{context}[]