// Module included in the following assemblies:
//
// assembly-using-the-user-operator.adoc
// assembly-configuring-kafka-listeners.adoc

[id='con-mutual-tls-authentication-{context}']
= Mutual TLS authentication for clients

== Mutual TLS authentication

Mutual authentication or two-way authentication is when both the server and the client present certificates. {ProductName} can configure Kafka to use TLS (Transport Layer Security) to provide encrypted communication between Kafka brokers and clients either with or without mutual authentication. When you configure mutual authentication, the broker authenticates the client and the client authenticates the broker. Mutual TLS authentication is always used for the communication between Kafka brokers and Zookeeper pods.

NOTE: In many common uses of TLS (such as the HTTPS protocol used between a web browser and a web server) the authentication is not mutual: Only one party to the communication gets proof of the identity of the other party.

TLS authentication is more commonly one-way, where only one party authenticates to another. For example, when the HTTPS protocol is used between a web browser and a web server, the authentication is not usually mutual and only the server  gets proof of the identity of the browser.

== When to use mutual TLS authentication for clients

Mutual TLS authentication is recommended for authenticating Kafka clients when:

* The client supports authentication using mutual TLS authentication
* It is necessary to use the TLS certificates rather than passwords
* You can reconfigure and restart client applications periodically so that they do not use expired certificates.
