16.5. Configuring external clients to trust the cluster CA

Using PKCS #12 format (.p12)

1. Extract the cluster CA certificate and password from the <cluster_name>-cluster-ca-cert Secret of the Kafka cluster.

   oc get secret <cluster_name>-cluster-ca-cert -o jsonpath='{.data.ca\.p12}' | base64 -d > ca.p12

   oc get secret <cluster_name>-cluster-ca-cert -o jsonpath='{.data.ca\.password}' | base64 -d > ca.password

   Replace <cluster_name> with the name of the Kafka cluster.

2. Configure the Kafka client with the following properties:

   • A security protocol option:

     • security.protocol: SSL when using TLS.
     • security.protocol: SASL_SSL when using SCRAM-SHA authentication over TLS.
   • ssl.truststore.location with the truststore location where the certificates were imported.
   • ssl.truststore.password with the password for accessing the truststore. This property can be omitted if it is not needed by the truststore.
   • ssl.truststore.type=PKCS12 to identify the truststore type.

Using PEM format (.crt)

1. Extract the cluster CA certificate from the <cluster_name>-cluster-ca-cert secret of the Kafka cluster.

   oc get secret <cluster_name>-cluster-ca-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt

2. Use the extracted certificate to configure a TLS connection in clients that use certificates in X.509 format.