// This assembly is included in the following assemblies:
//
// using/using.adoc

[id='security-{context}']
= Managing TLS certificates

Strimzi supports encrypted communication between the Kafka and Strimzi components using the TLS protocol.
Communication between Kafka brokers (interbroker communication), between ZooKeeper nodes (internodal communication), and between those components and the Strimzi operators is always encrypted.
Communication between Kafka clients and Kafka brokers is encrypted according to how the cluster is configured.
For the Kafka and Strimzi components, TLS certificates are also used for authentication.

The Cluster Operator automatically sets up and renews TLS certificates to enable encryption and authentication within your cluster.
It also sets up other TLS certificates if you want to enable encryption or TLS authentication between Kafka brokers and clients.
Certificates provided by users are not renewed.

You can provide your own server certificates, called _Kafka listener certificates_, for TLS listeners or external listeners which have TLS encryption enabled.
For more information, see xref:kafka-listener-certificates-str[].

.Example architecture of the communication secured by TLS
image::secure_communication.png[Secure Communication]

include::modules/con-certificate-authorities.adoc[leveloffset=+1]

include::modules/proc-installing-your-own-ca-certificates.adoc[leveloffset=+2]

include::modules/ref-certificates-and-secrets.adoc[leveloffset=+1]

include::modules/con-certificate-renewal.adoc[leveloffset=+1]

include::modules/proc-renewing-ca-certs-manually.adoc[leveloffset=+2]

include::modules/proc-replacing-private-keys.adoc[leveloffset=+2]

include::modules/proc-renewing-your-own-ca-certificates.adoc[leveloffset=+2]

include::modules/con-tls-connections.adoc[leveloffset=+1]

include::modules/proc-configuring-internal-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::modules/proc-configuring-external-clients-to-trust-cluster-ca.adoc[leveloffset=+1]

include::modules/con-kafka-listener-certificates.adoc[leveloffset=+1]

include::modules/proc-installing-certs-per-listener.adoc[leveloffset=+2]

include::modules/ref-alternative-subjects-certs-for-listeners.adoc[leveloffset=+2]
