Manage Certificate Authorities for mTLS authentication on Confluent Cloud

You can manage certificate authorities (CAs) for mTLS authentication using the Confluent Cloud Console, Confluent CLI, and Confluent Cloud APIs.

Create a Certificate Authority

You can create a Certificate Authority (CA) that is used for X.509 client certificate authentication for mTLS authentication using the Confluent Cloud Console, Confluent CLI, or the Confluent Cloud APIs.

To create a certificate authority using the Confluent Cloud Console:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.

  2. Click Add provider. The New identity provider page displays.

  3. Select Certificate authority for the authentication type.

  4. Enter the following details:

    Name Enter a meaningful name for your certificate authority.
    Description (Optional) Enter a description for the certificate authority.
  5. Click Add PEM file to upload the Certificate Authority (CA). Provide the certificate chain containing the root and any intermediate CAs used to verify client certificates. For details, see Requirements for mTLS.

  6. (Optional) Click Upload CRL file to upload the Certificate Revocation List (CRL). If the PEM file you uploaded contains the CRL URL, this is auto-populated. You can also manually provide the CRL URL.

  7. Confirm your Certificate Authority configuration details. The serial number and SHA-1 fingerprints are provided to let you match the values in your Certificate Authority with the values with your local files.

  8. Click Validate and save.

For details, see:

Describe a Certificate Authority

Get the details of a certificate authority.

To get the details of a certificate authority:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.
  2. Click the name of the certificate authority. The Certificate authority details page displays.

List all Certificate Authorities

Get a list of all Certificate Authorities.

To get a list of all Certificate Authorities:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.

The list of Certificate Authorities is displayed.

Update a Certificate Authority

Update a configured Certificate Authority.

To update a Certificate Authority:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.
  2. Click the name of the Certificate Authority. The Certificate authority details page displays.
  3. Click Edit to update the Certificate Authority details.
  4. Update the Certificate Authority details.
  5. Click Save.

Delete a Certificate Authority

Delete a Certificate Authority.

Important

Before deleting a Certificate Authority, you must delete any identity pools that reference the Certificate Authority.

To delete a Certificate Authority:

  1. In the Confluent Cloud Console, go to Account & access, then click Workload identities. Alternatively, click https://confluent.cloud/settings/org/workload-identities.
  2. Click the name of the Certificate Authority that you want to delete. The Certificate authority details page displays.
  3. Click Edit.
  4. At the bottom of the page, click Delete certificate authority.

After confirming the deletion, the Certificate Authority is deleted.

Email notifications

As certificates in a configured Certificate Authority approach their expiration dates, email notifications, titled “Action Required: Update expiring certificate authority”, are sent to principals with the Organization Admin role. These email notifications are sent progressively more often (60 days, 30 days, 7 days, 3 days, 2 days, and 1 day before expiration) until the Certificate Authority is updated. If all certificates in a configured Certificate Authority are expired, then any client certificates intended to authenticate with the expired Certificate Authority fail.