// Module included in the following assemblies:
//
// assembly-security.adoc

[id='certificate-authorities-{context}']
= Certificate Authorities

To support encryption, each {ProductName] component needs its own private keys and public key certificates.
All component certificates are signed by a Certificate Authority (CA) called the _cluster CA_.

Similarly, each Kafka client application connecting using TLS client authentication needs private keys and certificates.
The _clients CA_ is used to sign the certificates for the Kafka clients.

== CA certificates

Each CA has a self-signed public key certificate.

Kafka brokers are configured to trust certificates signed by either the clients CA or the cluster CA. Components to which clients do not need to connect, such as Zookeeper, only trust certificates signed by the cluster CA. Client applications that perform mutual TLS authentication have to trust the certificates signed by the cluster CA.

By default, {ProductName} generates and renews CA certificates automatically. You can configure the management of CA certificates in the `Kafka.spec.clusterCa` and `Kafka.spec.clientsCa` objects.
