> ## Documentation Index
> Fetch the complete documentation index at: https://docs.startree.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Prerequisites for SSL

To use SSL encryption, you must do the following:

* Obtain the bootstrap server endpoint (for the Pinot broker URL)
* Obtain the server certificate, the client certificate, and the client key

1. To locate the bootstrap server information to add the broker URL, open the `server.properties` file.

   <Note>
     The location of the server.properties file varies depending on the operating system being used. Contact your server administrator if you cannot locate this file.
   </Note>
2. Copy the entire line after bootstrap.servers that contain the list of bootstrap servers and ports.
   For example, copy `hostname1:9092, hostname2:9092` from the line below:

   ```bash theme={null}
    bootstrap.servers: hostname1:9092, hostname2:9092
   ```
3. If you're using SSL for authentication, obtain the server certificate, the client certificate, and the client key.

## Obtain SSL details for Apache Kafka

To obtain your Certificate Authority (CA) (server certificate), the client certificate, and the client key for Apache Kafka, complete the following steps:

1. Optional if you already have a Certificate Authority (CA) to sign. To create a CA, run the following command on the Kafka server command line:

   ```bash theme={null}
   openssl req -new -x509 -keyout ca-key -out ca-cert -days {validity}
   ```
2. To generate the client certificate and client key, do the following:

   a. Enter the following command on the Kafka server command line:

   ```bash theme={null}
   keytool -keystore {key_store_name}.jks -alias {key_store_name_alias} -keyalg RSA -validity {validity} -genkey
   ```

   <Note>
     The alias is just a shorter name for the key store. The same alias needs to be reused throughout the steps.
     Remember your passwords for each keystore or truststore to use later.
   </Note>

   b. Provide the answers to questions that are displayed on the interactive prompt. For the question What is your first and last name?, enter the CN for your certificate.

   <Note>
     The Common Name (CN) must match the fully qualified domain name (FQDN) of the server to ensure that StarTree connects to the correct server.
     Refer to this page to find the FQDN based on the server type.
   </Note>
3. To add the CA to the broker's truststore, run the following on the Kafka server command line:

   ```bash theme={null}
   keytool -keystore {broker_trust_store}.jks -alias CARoot -importcert -file ca-cert
   ```
4. To sign the certificates with the CA file, do the following on the Kafka server command line:

   a. Export the certificate from the keystore:

   ```bash theme={null}
   keytool -keystore {key_store_name}.jks -alias {key_store_name_alias} -certreq -file cert-file
   ```

   b. Sign the certificate with the CA:

   ```bash theme={null}
   openssl x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out cert-signed -days {validity} -CAcreateserial -passin pass:{ca-password}
   ```

   c. Add the certificates back to the keystore:

   ```bash theme={null}
      keytool -keystore {key_store_name}.jks -alias CARoot -importcert -file ca-cert

      keytool -keystore {key_store_name}.jks -alias {key_store_name_alias} -importcert -file cert-signed
   ```

   d. Extract the client certificate key from keystore. \
   i. Convert the keystore file from its existing `.jks` format to the PKCS12 (.p12) format for interoperability.
   To do this, enter the following command in the Kafka server command line:

   ```bash theme={null}
   keytool -v -importkeystore -srckeystore
   {key_store_name}.jks -srcalias
   {key_store_name_alias} -destkeystore
   {key_store_name}.p12 -deststoretype PKCS12
   ```

   ii. Extract the client certificate key into a `.pem` file (the format StarTree Cloud uses):

   ```bash theme={null}
   openssl pkcs12 -in {key_store_name}.p12 -nocerts -nodes > cert-key.pem
   ```

   iii. Go to the Kafka server folder with the Kafka truststore and keystore, and upload the following files to StarTree Cloud:

   * Client certificate: `cert-signed`
   * Client key: `cert-key.pem`
   * CA (server certificate): \`ca-cert

## Renew Kafka SSL certificates

To renew your Apache Kafka SSL certificates, do the following:

1. Update the SSL certificate entries in your Table configuration using Pinot APIs.
2. Use the `forceCommit` API to flush out the current consuming segments and start new Kafka consumers. The SSL certificates are updated.