anchor.diff:  using a public certificate authority (Thawte, Verisign and the like) is not necessary.
   A self-signed certificate authority local to the cluster or the environment (Dev, Q/A) should be enough.
   
  -So the first step is to create a certificate authority which will be used to sign the certificates of all hosts belonging to our cluster.
  +So the first step is to create a certificate authority that will be used to sign the certificates of all hosts belonging to our cluster.
   As this step will be done only once, I won't automate it.
   
   [source,shell]
  
positive.code: include::{source_dir}/openssl/tasks/main.yml[tags=main]
  ----
  
  Once you have the key, the cert and CA certs on the target host, you can start using them:
  
  [source,yaml]
  ----
  include::{source_dir}/openssl/tasks/main.yml[tags=after]
  ----
  
  The produced PKCS12 file can be used as a Java Keystore.
  
  The attentive reader has noticed I am using a bunch of `openssl_xxx` Ansible modules (namely `openssl_privatekey`, `openssl_csr`, `openssl_certificate` and `openssl_pkcs12`).
  These modules requires to have openssl and PyOpenSSL installed on each host.
  
  [source,yaml]
  ----
  
negative.code: <1> The CA root certificate will last 5 years
  <2> This certificate will be used as a CA
  <3> Generate both key and self-signed certificate
  <4> The key is protected with a password
  <5> Information describing the Root certificate
  
  For safety reasons, the generated key should be kept secret and stored in a secure place:
  
  * It must not be transfered to target Kafka servers
  * It must not be kept in source control (Git) unless hidden in Ansible Vault password file
  
  == The nodes certificates
  
  This is where Ansible comes in.
  As your cluster might have many nodes, automating certificate generation makes sense.
  For each target host, I will repeat the same process:
  
  image::{image_dir}/process.svg[Process]
  
  . On the target host, generate a key `target.key` and a CSR  (Certificate signing request) `target.csr`
  . Pull the CSR on the control host. 
  . Sign the CSR with the CA key.
    This will generate a certificate `target.crt`.
  