anchor.diff:  kubectl get kafka _KAFKA-CLUSTER-NAME_ -o jsonpath='{.status.listeners[?(@.type=="external")].bootstrapServers}'
   +
   Use the bootstrap address in your Kafka client to connect to the Kafka cluster.
  -
  -. Extract the public cluster CA certificate and password from the generated `_KAFKA-CLUSTER-NAME_-cluster-ca-cert` Secret.
  -+
  -[source,shell,subs="+quotes"]
  -kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.p12}' | base64 -d > ca.p12
  -+
  -[source,shell,subs="+quotes"]
  -kubectl get secret _KAFKA-CLUSTER-NAME_-cluster-ca-cert -o jsonpath='{.data.ca\.password}' | base64 -d > ca.password
  -+
  -Use the certificate and password in your Kafka client to connect to the Kafka cluster with TLS encryption.
  -+
  -NOTE: Cluster CA certificates renew automatically by default. If you are using your own Kafka listener certificates,
  -you will need to link:{BookURLUsing}#renewing-your-own-ca-certificates-str[renew the certificates manually^].
   
   . Create or modify a user representing the client that requires access to the Kafka cluster.
   +
  
positive.code: +
  NOTE: Use `security.protocol: SASL_SSL` when using SCRAM-SHA authentication over TLS.
  
  .. Add the bootstrap address and port for connecting to the Kafka cluster:
  +
  [source,env,subs="+quotes,attributes"]
  ----
  bootstrap.servers: _BOOTSTRAP-ADDRESS:PORT_
  ----
  
  .. Add the authentication details for the public user certificates:
  +
  [source,env,subs="+quotes,attributes"]
  ----
  ssl.keystore.location: _PATH-TO/ssl/keys/user1.keystore_ <1>
  ssl.keystore.password: _USER-CERT-PASSWORD_ <2>
  ----
  <1> Specifies the keystore location where the certificates were imported.
  <2> Specifies the password for accessing the keystore. This property can be omitted if it is not needed by the keystore.
  +
  The public user certificate is signed by the client CA when it is created.
  
  [role="_additional-resources"]
  .Additional resources
  
negative.code: In this procedure, the certificates generated by the Cluster Operator are used, but you can replace them by link:{BookURLUsing}#installing-your-own-ca-certificates-str[installing your own certificates^].
  You can also configure your listener to link:{BookURLUsing}#kafka-listener-certificates-str[use a Kafka listener certificate managed by an external Certificate Authority^].
  
  Certificates are available in PKCS #12 (.p12) and PEM (.crt) formats. 
  This procedure shows PKCS #12 certificates. 
  
  .Prerequisites
  
  