anchor.diff:  In this procedure, the certificates generated by the Cluster Operator are used, but you can replace them by link:{BookURLUsing}#installing-your-own-ca-certificates-str[installing your own certificates^].
   You can also configure your listener to link:{BookURLUsing}#kafka-listener-certificates-str[use a Kafka listener certificate managed by an external Certificate Authority^].
   
  -Certificates are available in PKCS #12 format (.p12) and PEM (.crt) formats.
  +Certificates are available in PKCS #12 (.p12) and PEM (.crt) formats. 
  +This procedure shows PKCS #12 certificates. 
   
   .Prerequisites
   
  
positive.code: kubectl get kafka _KAFKA-CLUSTER-NAME_ -o jsonpath='{.status.listeners[?(@.type=="external")].bootstrapServers}'
  +
  Use the bootstrap address in your Kafka client to connect to the Kafka cluster.
  
  . Extract the public cluster CA certificate and password from the generated `_KAFKA-CLUSTER-NAME_-cluster-ca-cert` Secret.
  +
  [source,shell,subs="+quotes"]
  kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.p12}' | base64 -d > ca.p12
  +
  [source,shell,subs="+quotes"]
  kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.password}' | base64 -d > ca.password
  +
  Use the certificate and password in your Kafka client to connect to the Kafka cluster with TLS encryption.
  +
  NOTE: Cluster CA certificates renew automatically by default. If you are using your own Kafka listener certificates,
  you will need to link:{BookURLUsing}#renewing-your-own-ca-certificates-str[renew the certificates manually^].
  
  . Create or modify a user representing the client that requires access to the Kafka cluster.
  +
  
negative.code: +
  NOTE: Use `security.protocol: SASL_SSL` when using SCRAM-SHA authentication over TLS.
  
  . Extract the user CA certificate from the user Secret to the desired certificate format:
  +
  [source,shell,subs="+quotes"]
  ----
  kubectl get secret _USER-NAME_ -o jsonpath='{.data.user\.p12}' | base64 -d > user.p12
  ----
  
  . Extract the password from the password file:
  +
  [source,shell,subs="+quotes"]
  ----
  kubectl get secret _USER-NAME_ -o jsonpath='{.data.user\.password}' | base64 -d > user.password
  ----
  
  . Configure your client with the authentication details for the user CA certificate:
  +
  .Sample client code
  [source,java,subs="+quotes,attributes+"]
  ----
  properties.put(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG,"/path/to/user.p12"); <1>
  properties.put(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG,"<user.password>"); <2>
  properties.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG,"PKCS12"); <3>
  ----
  <1> Specifies the keystore location where the certificates were imported.
  <2> Specifies the password for accessing the keystore. This property can be omitted if it is not needed by the keystore. The public user certificate is signed by the client CA when it is created.
  <3> Identifies the keystore type.
  
  . Add the bootstrap address and port for connecting to the Kafka cluster:
  +
  [source,env,subs="+quotes,attributes"]
  ----
  bootstrap.servers: _BOOTSTRAP-ADDRESS:PORT_
  ----
  
  [role="_additional-resources"]
  .Additional resources
  