anchor.diff:    user.crt: _USER-CERTIFICATE-CONTAINING-PUBLIC-KEY-OF-USER_
     user.key: _PRIVATE-KEY-OF-USER_
     user.p12: _P12-ARCHIVE-FILE-STORING-CERTIFICATES-AND-KEYS_
  -  user.password: _PASSWORD-PROTECTING-P12-ARCHIVE_
  -----
  -
  -. Configure your client to connect to the Kafka cluster with the properties required to make a secure connection to the Kafka cluster.
  -
  -.. Add the authentication details for the public cluster certificates:
  -+
  -[source,env,subs="+quotes,attributes"]
  -----
  -security.protocol: SSL <1>
  -ssl.truststore.location: _PATH-TO/ssl/keys/truststore_ <2>
  -ssl.truststore.password: _CLUSTER-CA-CERT-PASSWORD_ <3>
  -ssl.truststore.type=PKCS12 <4>
  +  user.password: _PASSWORD-PROTECTING-P12-ARCHIVE_  
  +----
  +
  +. Extract the public cluster CA certificate to the desired certificate format:
  ++
  +[source,shell,subs="+quotes"]
  +----
  +kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.p12}' | base64 -d > ca.p12
  +----
  +
  +. Extract the password from the password file:
  ++
  +[source,shell,subs="+quotes"]
  +----
  +kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.password}' | base64 -d > ca.password
  +----
  +
  +. Configure your client with the authentication details for the public cluster certificates:
  ++
  +.Sample client code
  +[source,java,subs="+quotes,attributes+"]
  +----
  +properties.put("security.protocol","SSL"); <1>
  +properties.put(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG,"/path/to/ca.p12"); <2>
  +properties.put(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG,_CA-PASSWORD_); <3>
  +properties.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG,"PKCS12"); <4>
   ----
   <1> Enables TLS encryption (with or without TLS client authentication).
   <2> Specifies the truststore location where the certificates were imported.
  
positive.code: In this procedure, the certificates generated by the Cluster Operator are used, but you can replace them by link:{BookURLUsing}#installing-your-own-ca-certificates-str[installing your own certificates^].
  You can also configure your listener to link:{BookURLUsing}#kafka-listener-certificates-str[use a Kafka listener certificate managed by an external Certificate Authority^].
  
  Certificates are available in PKCS #12 format (.p12) and PEM (.crt) formats.
  
  .Prerequisites
  
  
negative.code: +
  NOTE: Use `security.protocol: SASL_SSL` when using SCRAM-SHA authentication over TLS.
  
  . Extract the user CA certificate from the user Secret to the desired certificate format:
  +
  [source,shell,subs="+quotes"]
  ----
  kubectl get secret _USER-NAME_ -o jsonpath='{.data.user\.p12}' | base64 -d > user.p12
  ----
  
  . Extract the password from the password file:
  +
  [source,shell,subs="+quotes"]
  ----
  kubectl get secret _USER-NAME_ -o jsonpath='{.data.user\.password}' | base64 -d > user.password
  ----
  
  . Configure your client with the authentication details for the user CA certificate:
  +
  .Sample client code
  [source,java,subs="+quotes,attributes+"]
  ----
  properties.put(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG,"/path/to/user.p12"); <1>
  properties.put(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG,"<user.password>"); <2>
  properties.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG,"PKCS12"); <3>
  ----
  <1> Specifies the keystore location where the certificates were imported.
  <2> Specifies the password for accessing the keystore. This property can be omitted if it is not needed by the keystore. The public user certificate is signed by the client CA when it is created.
  <3> Identifies the keystore type.
  
  . Add the bootstrap address and port for connecting to the Kafka cluster:
  +
  [source,env,subs="+quotes,attributes"]
  ----
  bootstrap.servers: _BOOTSTRAP-ADDRESS:PORT_
  ----
  
  [role="_additional-resources"]
  .Additional resources
  