<style>
  input.search-bar {
    box-sizing: border-box;
    margin-bottom: 30px;
    font-size: 22px;
    padding: 20px;
    padding-left: 60px;
    border: 0;
    border-radius: 4px;
    box-shadow: none;
    flex: 1;
    width: 100%;
    color: #3B454F;
    line-height: 27.5px;
    background: #F1FAFF 20px 24px no-repeat url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAGqSURBVHgBrZRBTsJQEIZnHi6AkNiVeYRNDZC4xBMIN9AT0BuIJxBPwBHEExhPQDmB7NFYFiRNcNEFCZu2z5n2EUnpKwSd5KXT8vN15vWfh5AJy7KtSuXMiWNlI8I5AC7osev7Hy4cEbh7I2XrUQgYKAXWvlR5SkU93/c8OAYoZfsZUTn6dkpQNxEg2nS5ISBfgzDE3mo1nxUCuTJqb0griGO4y7Yn5ZUtRDiil9wydLMJL4PAC3KJLK7XW4qXlE0HCoI0k1TXGpo0AiDq6nzq+5/jAh5QhU9JWwj3RiBi3NFiFw7EzlZY7IZcoFLCghOiXIZ8INsBkgrVQTDv9zY32YeAaatCYN/Uxm+EfZ1MTQqh94WXVa2WRiZho9HusLU4p27GRqCu7oE9qBQ69Xrzi2zR3Qq4avYpjeK7fkT+i1wTEHcrIFO/6onIFycv5Y9hHkOxTZbL+UypUo/+9kIrK+RR7MXx2XX6G9LBUZpIadvGCrPBrbI1slXwl0aMJmkn+5UagUVRBD0JWAQ9GWiCluAPsV5/B7XaxRudo3ys2TTGC/iP0EfggPMf4IXM0qeAeMAAAAAASUVORK5CYII=);
    background-clip: padding-box;
    }
 </style>

 <script>
 function filterList() {
     // Get input value and convert to lowercase
     var input = document.getElementById("search-bar").value.toLowerCase();

     // Get all of the sections.
     var sections = document.getElementsByTagName("section")

     // Loop through the sections and check for h3s, which is the section type that contains the config values.
     for (var i = 0; i < sections.length; i++) {
     var section = sections[i];
     var h3Entries = section.getElementsByTagName("h3")
     // There is only 1 h3 in a section that contains a config value.
     if (h3Entries.length == 1) {
             // Now, check if the term matches the search input, and if so display the section. Otherwise, hide it.
         var h3text = h3Entries[0].textContent.toLowerCase();
         if (h3text.indexOf(input) > -1) {
             section.style.display ="";
         } else {
             section.style.display = "none";
         }
     }
     }
     }
   window.addEventListener('load', filterList);
 </script>

<a id="controlcenter-configuration"></a>

# Control Center Configuration Reference for Confluent Platform

The following settings are available for configuring Control Center.

Confluent Control Center includes several sample configuration (.properties) files in the following directory:
`$CONFLUENT_HOME/etc/confluent-control-center` For a list of sample
configuration files, see [Control Center Configuration Examples for Confluent Platform](properties.md#c3-properties-files).

## Search reference

Confluent Control Center groups settings into categories. You can search and filter by configuration property name.

<form>

  <input type="text" id="search-bar"
    class="search-bar"
    aria-label="Search"
    placeholder="Enter search text..."
    onkeyup="filterList()"
    autocomplete="off"></input>
 </form>

## Base settings

This section includes base settings for Control Center.

### bootstrap.servers

A list of host/port pairs to use for establishing the initial connection to
the Apache Kafka® cluster. The client will make
use of all servers irrespective of which servers are specified here for
bootstrapping; this list only impacts the
initial hosts used to discover the full set of servers. This list should be
in the form `host1:port1,host2:port2,...`. Since these servers are just
used for the initial connection to discover the full cluster membership
(which could change dynamically), this list need not contain the full set of
servers (you may want more than one, though, in case a server is down).

#### NOTE
When running Control Center in [Kafka-less mode](kafkaless-mode.md#c3-kafkaless-mode),
you can omit the `bootstrap.servers` property. This allows
Control Center to operate in a stateless configuration for environments
that don’t require Kafka-based state storage. For more information,
see [Kafka-less mode for Confluent Control Center](kafkaless-mode.md#c3-kafkaless-mode).

* Type: list
* Default: localhost:9092
* Importance: high

### confluent.license

Confluent issues an enterprise license key to each subscriber, allowing the
subscriber to unlock the full functionality of Control Center. The license key
is text that you can copy and paste. Paste the license key as the value
for `confluent.license`. You can also manage the license in
the Control Center web interface.

A trial license allows using for a 30-day trial period. A developer license
allows using Control Center and other Confluent Platform proprietary components indefinitely
for single-broker development environments. Trial and developer licenses are
shipped with Confluent Platform.

See [Manage Confluent Platform Licenses Using Control Center](license.md#controlcenter-licenses) for more details.

If you are a subscriber, contact Confluent Support for more
information about obtaining another valid enterprise license before it
expires. `confluent.controlcenter.license` is a deprecated synonym for
this configuration key.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.rest.csrf.prevention.enable

When enabled, uses a token-based system to help prevent Cross-Site Request Forgery (CSRF). CSRF is
a malicious exploit that can result in an end user executing unwanted actions on a web application in which
they’re currently authenticated. If the target user has an administrative account,
CSRF can compromise the entire web application.

* Type: boolean
* Default: false
* Importance: medium

### confluent.controlcenter.rest.csrf.prevention.token.expiration.minutes

Sets the CSRF prevention token expiration time, if CSRF prevention is enabled.
The default expiration time should be sufficient for most use cases, however you
can use this setting to increase or decrease the token expiration interval time if needed.

* Type: int
* Default: 30
* Importance: low

### confluent.controlcenter.rest.thread.pool.max

The maximum number of threads that will be started for the HTTP Servlet server.

* Type: int
* Default: 200
* Importance: low

### confluent.controlcenter.rest.thread.pool.min

The minimum number of threads that will be started for the HTTP Servlet server.

* Type: int
* Default: 8
* Importance: low

## Production Settings

In production, you should run Control Center in a cluster that is separate from
the Kafka clusters being monitored. Set the following configuration parameters
in the Control Center properties file.

<a id="c3-addl-cluster-boot-servers"></a>

### confluent.controlcenter.kafka.<name>.bootstrap.servers

Bootstrap servers for any additional Kafka cluster being monitored. Replace
`<name>` with the name Control Center should use to identify this cluster. For
example, using `confluent.controlcenter.kafka.production-nyc.bootstrap.servers`,
Control Center will show the additional cluster with the name `production-nyc` in
the cluster list.

* Type: list
* Default: “”
* Importance: high

<a id="c3-addl-connection-config-cluster-name"></a>

### confluent.controlcenter.kafka.<name>.<connection config>

Any additional connection configuration required to connect to the Kafka
cluster identified by `<name>` can be specified using the
`confluent.controlcenter.kafka.<name>.` prefix.
For example, to specify the `security.protocol=SASL_SSL` configuration for
the cluster named `production-nyc`, add
`confluent.controlcenter.kafka.production-nyc.security.protocol=SASL_SSL`
to the configuration.

* Importance: medium

<a id="mode-settings"></a>

## Mode settings

Use this optional setting to specify the [mode](../overview.md#control-center-modes) that Confluent Control Center starts in.
By default, Control Center starts in Normal mode, meaning `all` is specified, and monitoring is enabled.

### confluent.controlcenter.mode.enable

Set the mode in which Control Center should be started.
Valid values are `all`, meaning Confluent Control Center operates normally, and `management` meaning Confluent Control Center uses less
infrastructure to operate. In [Reduced infrastructure mode](../overview.md#reduced-infra-mode), Control Center
is used to manage Kafka clusters only and will not display monitoring or metrics information.

To run Control Center in reduced infrastructure mode, set this property to `management`
and `confluent.controlcenter.prometheus.enable` to `false`.

```none
confluent.controlcenter.prometheus.enable=false
```

#### NOTE
When `management` mode is combined with CMF enabled
(`confluent.controlcenter.cmf.enable=true`) and Prometheus disabled,
Control Center can run in [Kafka-less mode](kafkaless-mode.md#c3-kafkaless-mode) without
a bootstrap Kafka cluster. For complete configuration details,
see [Kafka-less mode for Confluent Control Center](kafkaless-mode.md#c3-kafkaless-mode).

* Type: string
* Default: all
* Importance: high

## General settings

General settings for Control Center are optional.

### confluent.controlcenter.data.dir

Location for Control Center-specific data. Although the data stored in this
directory can be recomputed, doing so is expensive and can affect the
availability of Control Center’s stream monitoring functionality. For production,
you should set this to a durable, writable, and secure location.

* Type: path
* Default: `/var/lib/confluent-control-center` (`control-center-production.properties`)
* Default: `/tmp/confluent/control-center` (`control-center.properties`, `control-center-dev.properties`, `control-center-minimal.properties`)
* Importance: high

<a id="rest-listeners"></a>

### confluent.controlcenter.rest.listeners

Comma-separated list of listeners that listen for API requests over either http or https. If a listener uses https,
the appropriate TLS/SSL configuration parameters need to be set as well. The first value will be used as a Control Center link in the body of eligible alert emails sent from Control Center. For details, see [Alerts history](../alerts/navigate.md#alert-history).

* Type: list
* Default: `http://0.0.0.0:9021`
* Importance: high

<a id="c3-rest-adv-url"></a>

### confluent.controlcenter.rest.advertised.url

Externally visible host. Control Center uses this as an override to
`rest.listeners` when generating URLs for external communications
such as alert emails.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.rest.access.control.allow.origin

Sets the value for Jetty Access-Control-Allow-Origin header.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.rest.response.http.headers.config

Use to select which HTTP headers are returned in the HTTP response for Confluent Platform
components. Specify multiple values in a comma-separated string using the
format `[action][header name]:[header value]` where `[action]` is one of
the following: `set`, `add`, `setDate`, or `addDate`. You must use
quotation marks around the header value when the header value contains commas.
For example:

```none
response.http.headers.config="add Cache-Control: no-cache, no-store, must-revalidate", add X-XSS-Protection: 1; mode=block, add Strict-Transport-Security: max-age=31536000; includeSubDomains, add X-Content-Type-Options: nosniff
```

* Type: string
* Default: “”
* Importance: low

<a id="confluent-controlcenter-streams-cprest-url"></a>

### confluent.controlcenter.streams.cprest.url

Defines the REST endpoints for Control Center to enable HTTP servers on the broker(s).
A comma-separated list with multiple values can be provided for a multi-broker cluster.

For examples, see [/platform/current/Configure Control Center with REST endpoints and advertised listeners](/platform/current/Configure Control Center with REST endpoints and advertised listeners), [Required Configurations for Control Center](/platform/current/clusters/sbc/configuration-options.html#sbc-configs-c3), and [Self-Balancing Clusters](/platform/current/clusters/sbc/index.html#sbc) documentation.

* Type: list
* Default: `http://localhost:8090`
* Importance: high

To configure multiple clusters, see
[confluent.controlcenter.kafka.name.cprest.url](#confluent-controlcenter-kafka-name-url).

<a id="confluent-controlcenter-kafka-name-url"></a>

### confluent.controlcenter.kafka.<name>.cprest.url

Defines the REST endpoints for any additional Kafka clusters being monitored by Control Center to enable HTTP
servers on the broker(s). Replace `<name>` with the name that identifies this cluster.
This name should be consistent with the Kafka cluster name used for other Control Center configurations.
A comma-separated list with multiple values can be provided for a multi-broker cluster.

Note that if the REST API endpoints are secured with TLS, you must include additional properties
in the Confluent Control Center properties file that provide the security information. For more information,
see [Configure TLS for Control Center as a server](../security/ssl.md#controlcenter-ui-https) and [TLS settings for web access](#https-settings).

The following example shows REST endpoint settings for three clusters or data centers (dc1, dc2, and dc3):

```bash
confluent.controlcenter.streams.cprest.url=https://dc1:8090
confluent.controlcenter.kafka.dc2.cprest.url=https://dc2:8090
confluent.controlcenter.kafka.dc3.cprest.url=https://dc3:8090
```

* Type: list
* Default: “”
* Importance: high

For an example of configuring the Control Center `cprest.url` specifically for multiple clusters, see [Enabling Multi-Cluster Schema Registry](/platform/current/control-center/topics/schema.html#multi-cluster-sr).

<a id="confluent-controlcenter-id-setting"></a>

### confluent.controlcenter.id

Identifier used as a prefix so that multiple instances of Control Center can
co-exist.

* Type: string
* Default: “1”
* Importance: low

### confluent.controlcenter.name

Control Center Name

* Type: string
* Default: \_confluent-controlcenter-2.6.0
* Importance: low

### confluent.controlcenter.disk.skew.warning.min.bytes

Threshold for the max difference in disk usage across all brokers
before disk skew warning is published.

* Type: long
* Default: 1,073,741,824
* Importance: low

### confluent.controlcenter.ui.data.expired.threshold

Configure a threshold (in seconds) before data is considered out of date.
Default: 120 seconds (2 minutes).

* Type: int
* Default: 120
* Importance: low

### confluent.controlcenter.service.healthcheck.interval.sec

The interval (in seconds) used for checking the health of Confluent Platform nodes. This includes ksqlDB,
Connect, Schema Registry, REST Proxy, and Metadata Service (MDS).

* Type: int
* Default: 20
* Importance: low

<a id="c3-request-buffer-size"></a>

### confluent.controlcenter.request.buffer.size.bytes

Allows adjustment of the RequestBuffer size of HttpClient.

* Type: int
* Default: 10,000
* Importance: low

### confluent.controlcenter.prometheus.url

A valid URL  to access the Prometheus server on the Control Center.  The hostname must
be reachable from any browser that will use the web interface in the Control Center.

* Type: string
* Default: “[http://localhost:9090](http://localhost:9090)”
* Importance: high

### confluent.controlcenter.prometheus.rules.file

Location for Prometheus-specific config file.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.prometheus.alertmanager.yaml.refresh.enabled

Enables the alerts and triggers replication job for Active/Active high-availability (HA) deployments.
When set to `true`, alerts and triggers are automatically replicated between Control Center
instances, so you do not need to manually duplicate them. This configuration is available in Control Center 2.5 and later.

* Type: boolean
* Default: false
* Importance: high

### confluent.controlcenter.alertmanager.url

A valid URL  to access the Alertmanager service on the Control Center.  The hostname must
be reachable from any browser that will use the web interface in the Control Center.

* Type: string
* Default: “[http://localhost:9093](http://localhost:9093)”
* Importance: high

### confluent.controlcenter.alertmanager.config.file

Location for Alertmanager specific config file.

* Type: string
* Default:
* Importance: high

<a id="c3-webhook-whitelist"></a>

### confluent.controlcenter.webhook.whitelist.urls

Use this configuration for alerts configured to use generic webhooks. This configuration allows you to whitelist selected
destination endpoints for alert notifications. Use a comma-separated list of URLs.

If this configuration is not set, all URLs are allowed.

If the whitelist is added *after* the alert has been created, the whitelist does not work. In this case, delete the alert,
whitelist the URLs, and then re-create the alert.

* Type: string
* Default:
* Importance: high

<a id="c3-docs-host"></a>

### confluent.controlcenter.docs.host

Base URL of a customer-hosted documentation site used to resolve Control Center
in-product help links, such as Learn more, troubleshooting, and documentation
links. When set, help links open against this host instead of
`https://docs.confluent.io`, and version segments such as `/current` are
removed. When unset or empty, help links use `https://docs.confluent.io`.

Provide the host or base URL only, for example, `https://docs.customer.example`,
not a link to a specific page.

Use this setting in air-gap, restricted-network, or self-hosted
environments where you cannot reach `https://docs.confluent.io` directly but
still need working help links from the Control Center web interface.

* Type: string
* Default: “”
* Importance: low

#### NOTE
This setting only redirects supported help links to a customer-managed host.
It does not create, synchronize, or version-select offline documentation. You must
host the documentation version that matches your deployed product.

**Host self-managed documentation for help links**

Control Center rewrites only the host portion of a help link and strips the
version segment, such as `/current`. It does not remap product names or
assemble a documentation site for you. You must host the matching bundles so
that the resolved paths exist on your custom host.

1. Download the documentation bundles from [https://docs.confluent.io/archive/](https://docs.confluent.io/archive/).
   Each product has its own bundle.
2. Choose bundles that match the exact Control Center and Confluent Platform versions that you
   deployed. The UI does not preserve public documentation version segments such as
   `/current`.
3. Extract the bundles under a single web root served by the host that you
   configure in `confluent.controlcenter.docs.host`.
4. Name each top-level folder to match the path prefix that Control Center
   expects. For details, see the following table.
5. Verify a few help links from the Control Center UI before rollout.

Currently, the following documentation base paths are translated:

* `Confluent Platform` maps to `/platform/`
* `Control Center for Confluent Platform` maps to `/control-center/`
* `Confluent Platform for Apache Flink` maps to `/cp-flink/`

For example, with `confluent.controlcenter.docs.host` set to
`https://docs.customer.example`, help links resolve as follows:

| Public docs link                                                           | Self-hosted path expected by Control Center   | Customer-hosted location                                               |
|----------------------------------------------------------------------------|-----------------------------------------------|------------------------------------------------------------------------|
| `https://docs.confluent.io/control-center/current/installation/index.html` | `/control-center/installation/index.html`     | `https://docs.customer.example/control-center/installation/index.html` |
| `https://docs.confluent.io/platform/current/security/index.html`           | `/platform/security/index.html`               | `https://docs.customer.example/platform/security/index.html`           |

**Limitations**

* Version information is removed. Self-hosted links do not retain segments such
  as `/current`, so the configured host must already represent the correct
  documentation version. To support multiple deployed versions, host a separate
  documentation tree per version and point each Control Center deployment at the
  appropriate host.
* Documentation is provided as separate product bundles. You must assemble the
  hosted documentation site from individual product bundles and serve each
  bundle under the path that Control Center expects. For example, `/control-center/`
  for Control Center documentation.
* Paths must match the expected layout. If the self-hosted site does not match the
  expected path layout, help links break. If the hosted bundle does not provide the
  generated path, the browser reaches the custom host but the page returns an
  error.

<a id="broker-settings"></a>

## Broker UI settings

Starting with Confluent Platform version 7.0.0, Control Center uses an embedded REST proxy and as a result provides
an updated UI to display broker settings. These settings are optional.

### confluent.controlcenter.embedded.kafkarest.enable

Enables or disables the use of an embedded REST proxy for Control Center, which must be
enabled for Confluent Control Center to display the new broker settings UI. Starting with Confluent Platform version 7.0.0,
Control Center uses an embedded REST proxy and as a result provides an updated UI to display
broker settings. The new settings UI is enabled by default, but you can revert back to
the old view with this setting and `confluent.controlcenter.ui.brokersettings.kafkarest.enable`.

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.ui.brokersettings.kafkarest.enable

Enables or disables new broker settings UI. This setting will be forced to false
if `confluent.controlcenter.embedded.kafkarest.enable` is also false.

* Type: boolean
* Default: true
* Importance: low

## UI customization settings

Use these optional settings to customize the Control Center user interface
with pre-login notices and classification banners for regulatory compliance,
security markings, and user agreements.

### confluent.controlcenter.ui.user.agreement.notice.enable

Enable a customizable pre-login notice dialog that appears before users log in
to Control Center. When you enable this setting, users must accept the notice
by selecting a checkbox and clicking a button before they can log in. An XML
template file defines the dialog content.

* Type: boolean
* Default: false
* Importance: low

### confluent.controlcenter.ui.user.agreement.notice.file

The path to the XML template file that defines the pre-login notice dialog
content. The XML file can include a title, warning text, bullets, links, and
paragraphs. Control Center includes a default template file at
`etc/confluent-control-center/user-agreement-notice.xml` that you can edit
to customize the notice content.

Use this setting only when you set
`confluent.controlcenter.ui.user.agreement.notice.enable` to `true`.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ui.banner.top.text

The text to display in a persistent banner at the top of all Control Center
pages after login. Use this banner for classification markings, outage
notifications, or regulatory notices. Classification marking examples include
SECRET and UNCLASSIFIED. The banner displays a single centered line of text.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ui.banner.top.color

The background color for the top banner. Specify one of the following
predefined color names: `red`, `yellow`, `orange`, `blue_navy`,
`blue_light`, `green`, `purple`, or `violet`.

Use this setting only when you configure
`confluent.controlcenter.ui.banner.top.text`.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ui.banner.bottom.text

The text to display in a persistent banner at the bottom of all Control Center
pages after login. Use this banner for classification markings, outage
notifications, or regulatory notices. Classification marking examples include
`SECRET` and `UNCLASSIFIED`. The banner displays a single centered line of text.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ui.banner.bottom.color

The background color for the bottom banner. Specify one of the following
predefined color names: `red`, `yellow`, `orange`, `blue_navy`,
`blue_light`, `green`, `purple`, or `violet`.

Use this setting only when you configure
`confluent.controlcenter.ui.banner.bottom.text`.

* Type: string
* Default: “”
* Importance: low

<a id="ui-authentication-settings"></a>

## Basic Authentication settings for web access

These optional settings allow you to enable and configure authentication for
accessing the Control Center web interface. See the
[Configure HTTP Basic Authentication with Control Center on Confluent Platform](../security/authentication.md#ui-authentication)
guide for more details on configuring authentication.

### confluent.controlcenter.rest.authentication.method

Authentication method to use. Available options: NONE, BASIC, BEARER.

#### IMPORTANT
When RBAC is enabled in Control Center, the method must be
`BEARER`. For more information,
see [Configure RBAC for Control Center on Confluent Platform](../security/c3-rbac.md#controlcenter-security-rbac).

* Type: string
* Default: NONE
* Importance: low

### confluent.controlcenter.rest.authentication.realm

Realm to be used by Control Center when authenticating.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.rest.authentication.roles

Roles that are authenticated to access Control Center.

* Type: string
* Default: \*
* Importance: low

### confluent.controlcenter.auth.restricted.roles

Specify a list of roles with limited read-only access. You must include roles
added here in `confluent.controlcenter.rest.authentication.roles`. For users that are members of
roles included in this list, the following features and options are unavailable:

* Add, delete, pause, or resume connectors
* Browse connectors
* View connector settings
* Upload connector configs
* Create, delete, or edit alerts (triggers or actions)
* Edit a license
* Edit brokers
* Press submit on cluster forms
* Edit, create, or delete schemas
* Edit data flow queries
* [Inspect topics](../topics/messages.md#c3-topic-message-browser)
* Type in the KSQL editor
* [Run or stop ksqlDB queries](../ksql.md#controlcenter-userguide-ksql)
* Add ksqlDB streams or table

Access for these roles is enforced based on the HTTP method of each request
rather than the semantic operation it performs. For details, including the
known exceptions, see [How read-only roles are enforced](../security/authentication.md#c3-restricted-roles-enforcement).

For fine-grained access control, consider configuring
[role-based access control (RBAC)](../security/c3-rbac.md#controlcenter-security-rbac).

* Type: list
* Default: “”
* Importance: low

### confluent.controlcenter.auth.session.expiration.ms

Timeout in milliseconds after which a user session is re-authenticated with the
authentication service (for example, LDAP). Defaults to 0, which means
authentication is done for every request. Increase this value to avoid calling
the LDAP service for each request.

#### NOTE
This property controls only how frequently Control Center re-authenticates a
user against the authentication service, and it applies to basic
authentication. It does not force a login session to expire or sign a user
out automatically. In a deployment that uses RBAC with bearer-token
authentication, this property does not affect the login session. To limit
how long a login session can last before the user must log in again, use
`confluent.controlcenter.auth.bearer.token.max.lifetime.ms` instead.

* Type: long
* Default: 0
* Importance: low

<a id="https-settings"></a>

## TLS settings for web access

Configure the following optional properties to secure web access (HTTPS) to Control Center with TLS.

To configure TLS settings when Control Center acts as
a proxy server to other Confluent Platform components, see [Configure TLS for Control Center on Confluent Platform](../security/ssl.md#controlcenter-security-ssl).

### confluent.controlcenter.rest.listeners

Comma-separated list of listeners that listen for API requests over either http or https. If a listener uses https,
the appropriate TLS/SSL configuration parameters need to be set as well. The first value will be used as a Control Center link in the body of eligible alert emails sent from Control Center. For details, see [Alerts history](../alerts/navigate.md#alert-history).

* Type: list
* Default: `http://0.0.0.0:9021`
* Importance: high

### confluent.controlcenter.rest.ssl.keystore.location

Used for HTTPS. Location of the keystore file to use for TLS.

#### IMPORTANT
Jetty requires that the key’s CN stored in the keystore must
match the FQDN.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.rest.ssl.keystore.password

Used for HTTPS. The store password for the keystore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.rest.ssl.key.password

Used for HTTPS. The password of the private key in the keystore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.rest.ssl.truststore.location

Used for HTTPS. Location of the truststore. Required only to authenticate
HTTPS clients.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.rest.ssl.truststore.password

Used for HTTPS. The store password for the truststore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.rest.ssl.keystore.type

Used for HTTPS. The type of keystore file.

* Type: string
* Default: JKS
* Importance: medium

### confluent.controlcenter.rest.ssl.truststore.type

Used for HTTPS. The type of truststore file.

* Type: string
* Default: JKS
* Importance: medium

### confluent.controlcenter.rest.ssl.protocol

Used for HTTPS.
The TLS protocol used to generate the SSLContext. The default is `TLSv1.3`
when running with Java 11 or newer, `TLSv1.2` otherwise. This value should
be fine for most use cases. Allowed values in recent JVMs are `TLSv1.2` and
`TLSv1.3`. `TLS`, `TLSv1.1`, `SSL`, `SSLv2` and `SSLv3` might be
supported in older JVMs, but their usage is discouraged due to known security
vulnerabilities. With the default value for this configuration and `ssl.enabled.protocols`,
clients downgrade to `TLSv1.2` if the server does not support `TLSv1.3`.
If this configuration is set to `TLSv1.2`, clients do not use `TLSv1.3`,
even if it is one of the values in `ssl.enabled.protocols` and the server
only supports `TLSv1.3`.

* Type: string
* Default: `TLSv1.3`
* Importance: medium

### confluent.controlcenter.rest.ssl.provider

Used for HTTPS. The TLS security provider name. Leave blank to use the defaults for Jetty.

* Type: string
* Default: “” (Jetty default)
* Importance: medium

### confluent.controlcenter.rest.ssl.client.auth

Deprecated. Used for HTTPS. Whether to require the HTTPS client to authenticate
using the server’s truststore. This is deprecated by `confluent.controlcenter.rest.ssl.client.authentication`.

* Type: boolean
* Default: false
* Importance: medium

### confluent.controlcenter.rest.ssl.client.authentication

Used for HTTPS. Valid values: NONE, REQUESTED or REQUIRED. NONE disables TLS client authentication,
REQUESTED requests but doesn’t require TLS client authentication, and REQUIRED requires HTTPS clients to
authenticate using the server’s truststore. This config overrides
`confluent.controlcenter.rest.ssl.client.auth` (deprecated).

* Type: string
* Default: NONE
* Importance: medium

### confluent.controlcenter.rest.ssl.enabled.protocols

Used for HTTPS. Leave blank (`""`) to use the Jetty default.
The comma-separated list of protocols enabled for TLS connections.
The default value is `TLSv1.2,TLSv1.3` when running with Java 11 or later,
`TLSv1.2` otherwise. With the default value for Java 11 (`TLSv1.2,TLSv1.3`),
Kafka clients and brokers prefer `TLSv1.3` if both support it, and falls back to
`TLSv1.2` otherwise (assuming both support at least `TLSv1.2`).

* Type: list
* Default: “” (Jetty default)
* Importance: medium

### confluent.controlcenter.rest.ssl.keymanager.algorithm

Used for HTTPS. The algorithm used by the key manager factory for TLS
connections. Leave blank to use the Jetty default.

* Type: string
* Default: “” (Jetty default)
* Importance: low

### confluent.controlcenter.rest.ssl.trustmanager.algorithm

Used for HTTPS. The algorithm used by the trust manager factory for TLS
connections. Leave blank to use the Jetty default.

* Type: string
* Default: “” (Jetty default)
* Importance: low

### confluent.controlcenter.rest.ssl.cipher.suites

A comma-separated list of TLS cipher suites used for HTTPS.
Leave blank to use the Jetty default or specify any combination of the following suites:

- `TLS_AES_256_GCM_SHA384`
- `TLS_CHACHA20_POLY1305_SHA256`
- `TLS_AES_128_GCM_SHA256`
- `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`
- `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
- `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256`
- `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256`
- `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`
- `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`

Using another cipher suite name causes Confluent Control Center to fail to start.
Ciphers listed [here](https://httpwg.org/specs/rfc7540.html#BadCipherSuites)
are not supported. Do not use them.

* Type: list
* Default: “” (Jetty default)
* Importance: low

### confluent.controlcenter.rest.ssl.endpoint.identification.algorithm

Used for HTTPS. The endpoint identification algorithm to validate the server
hostname using the server certificate. Leave blank to use the Jetty default.

* Type: string
* Default: https
* Importance: low

### confluent.controlcenter.use.default.jvm.truststore

Enable Control Center to fallback to use the default JVM trust store.

* Type: string
* Default: false
* Importance: low

### confluent.controlcenter.use.default.os.truststore

Enable Control Center to fallback to use the default operating system trust store.

* Type: string
* Default: false
* Importance: low

### confluent.controlcenter.prometheus.ssl.truststore.location

Used for HTTPS. Location of the truststore. Required only to authenticate HTTPS clients.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.prometheus.ssl.truststore.password

Used for HTTPS. The store password for the truststore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.prometheus.alias.name

Specifies an alias for the certificate Prometheus uses during TLS.

Use the following format to specify `<Certificate-Alias>` as an alias:

```none
confluent.controlcenter.prometheus.alias.name=<Certificate-Alias>
```

If you have multiple trustStores, each certificate should have a unique alias, even if you are using the same
certificate for multiple connections.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.prometheus.ssl.keystore.location

Used for HTTPS. Location of the keystore file to use for TLS.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.prometheus.ssl.keystore.password

Used for HTTPS. The store password for the keystore file.

* Type: password
* Default: “”
* Importance: high

### Confluent.controlcenter.prometheus.ssl.key.password

Used for HTTPS. The password of the private key in the keystore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.prometheus.basic.auth.user.info

Specifies the user credentials for HTTP Basic Authentication in the form of `{username}:{password}` for Prometheus server.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.alertmanager.ssl.truststore.location

Used for HTTPS. Location of the truststore. Required only to authenticate HTTPS clients.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.alertmanager.ssl.truststore.password

Used for HTTPS. The store password for the truststore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.alertmanager.alias.name

Specifies an alias for the certificate Alertmanager uses during TLS.

Use the following format to specify <Certificate-Alias> as an alias:

```none
confluent.controlcenter.alertmanager.alias.name=<Certificate-Alias>
```

If you have multiple trustStores, each certificate should have a unique alias, even if you are using the
same certificate for multiple connections.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.alertmanager.ssl.keystore.location

Used for HTTPS. Location of the keystore file to use for TLS.

* Type: string
* Default: “”
* Importance: high

### confluent.controlcenter.alertmanager.ssl.keystore.password

Used for HTTPS. The store password for the keystore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.alertmanager.ssl.key.password

Used for HTTPS. The password of the private key in the keystore file.

* Type: password
* Default: “”
* Importance: high

### confluent.controlcenter.alertmanager.basic.auth.user.info

Specifies the user credentials for HTTP Basic Authentication in the form of `{username}:{password}` for Alertmanager service.

* Type: string
* Default: “”
* Importance: medium

<a id="controlcenter-configuration-encryption"></a>

<a id="kafka-encryption-authentication-authorization-settings"></a>

## Security for Confluent Platform components settings

The following optional settings control TLS encryption between Control Center
and Confluent Platform components or features. You can also configure Basic authentication
for Schema Registry.

You should configure these settings if you have configured your Kafka cluster with
these security features. For TLS, you can choose to configure each component separately, or
set a single store.

- [Streams](#controlcenter-monitoring)
- [Schema Registry](#controlcenter-sr)
- [Connect](#controlcenter-connect)
- [ksqlDB](#controlcenter-ksql)
- [Single Proxy Server Store](#single-store)

<a id="controlcenter-monitoring"></a>

## Streams security settings

These optional settings are the standard Kafka authentication and authorization settings
prefixed with `confluent.controlcenter.streams.`.

### confluent.controlcenter.streams.security.protocol

Protocol used to communicate with brokers. Valid values are: `PLAINTEXT`, `SSL`,
`SASL_PLAINTEXT`, and `SASL_SSL`.

* Type: string
* Default: `PLAINTEXT`
* Importance: low

### confluent.controlcenter.streams.ssl.keystore.location

The location of the keystore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.streams.ssl.keystore.password

The store password for the keystore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.streams.ssl.key.password

The password of the private key in the keystore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.streams.ssl.truststore.location

The location of the truststore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.streams.ssl.truststore.password

The password for the truststore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.streams.sasl.mechanism

SASL mechanism used for client connections. This may be any mechanism for
which a security provider is available. GSSAPI is the default mechanism.

* Type: string
* Default: GSSAPI
* Importance: low

### confluent.controlcenter.streams.sasl.kerberos.service.name

The Kerberos principal name that Kafka runs as. This can be defined either in
Kafka’s JAAS config or in Kafka’s config.

* Type: string
* Default: null
* Importance: low

### confluent.controlcenter.streams.sasl.login.callback.handler.class

The fully qualified name of a SASL login callback handler class that implements
the AuthenticateCallbackHandler interface.

In Control Center `2.2` and higher, the OAuth handler class was replaced as follows:

- `org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler` was changed to `org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginCallbackHandler`

In Control Center `2.2` and higher, your configuration should look like this:

```none
confluent.controlcenter.streams.sasl.login.callback.handler.class=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginCallbackHandler
```

* Type: class
* Default: null
* Importance: low

<a id="email-settings"></a>

## Email settings

These optional settings control the SMTP server and account used when an
[alert](../alerts/index.md#controlcenter-userguide-alerts) triggers the
[email action](../alerts/actions.md#actions-mgmnt).

#### IMPORTANT
The body of the email alert is populated with the first hostname
specified in the `confluent.controlcenter.rest.listeners`
property. The default value is `localhost:9021`.

### confluent.controlcenter.mail.enabled

Enable email alerts. If this setting is false, you cannot add email alert
actions in the web user interface.

* Type: boolean
* Default: false
* Importance: low

### confluent.controlcenter.mail.host.name

Hostname of outgoing SMTP server.

* Type: string
* Default: localhost
* Importance: low

### confluent.controlcenter.mail.port

SMTP port open on `confluent.controlcenter.mail.host.name`.

* Type: int
* Default: 587
* Importance: low

### confluent.controlcenter.mail.ssl.checkserveridentity

Forces the use of TLS and validation of the server’s certificate.
Enabling this flag causes Control Center to use the port set by
`confluent.controlcenter.mail.ssl.port` instead of
`confluent.controlcenter.mail.port`.

* Type: boolean
* Default: false
* Importance: low

### confluent.controlcenter.mail.ssl.port

SSL-specific SMTP port to open on `confluent.controlcenter.mail.host.name`.
Setting `confluent.controlcenter.mail.ssl.checkserveridentity` to `true` forces the
use of this port and not the `confluent.controlcenter.mail.port`.

* Type: int
* Default: 465
* Importance: low

### confluent.controlcenter.mail.from

The originating address for emails sent from Control Center.

* Type: string
* Default: [c3@confluent.io](mailto:c3@confluent.io)
* Importance: low

### confluent.controlcenter.mail.bounce.address

Override for `confluent.controlcenter.mail.from` config to send message
bounce notifications.

* Type: string
* Importance: low

### confluent.controlcenter.mail.starttls.required

Forces using STARTTLS.

* Type: boolean
* Default: false
* Importance: low

### confluent.controlcenter.mail.username

Username for username/password authentication. Authentication with your
SMTP server only performs if this value is set.

* Type: string
* Importance: low

### confluent.controlcenter.mail.password

Password for username/password authentication.

* Type: string
* Importance: low

<a id="controlcenter-access-control-settings"></a>

## Features

This section organizes all feature-specific configurations, including both general settings and security configurations for each feature. Each feature subsection contains all related configurations in one place.

<a id="cmf-c3-config"></a>

<a id="controlcenter-cmf-feature"></a>

## Confluent Manager for Apache Flink (CMF)

Use these settings to configure Confluent Manager for Apache Flink (CMF) integration with Confluent Control Center. For more information, see [Use Confluent Control Center with Confluent Manager for Apache Flink](../cmf.md#cmf-flink-c3).

## (CMF) general settings

### confluent.controlcenter.cmf.enable

Enable user access to CMF. Use the following
format to enable:

```none
confluent.controlcenter.cmf.enable=true
```

For more information, see [Use Confluent Control Center with Confluent Manager for Apache Flink](../cmf.md#cmf-flink-c3).

* Type: boolean
* Default: false
* Importance: low

### confluent.controlcenter.cmf.url

CMF server hostname and listener port. By default, this is empty. These hostnames must be reachable from
the Control Center host. Use the following format to specify `<cmf-url>` as the CMF server hostname and listener port:

```none
confluent.controlcenter.cmf.url=<cmf-url>
```

For more information, see [Use Confluent Control Center with Confluent Manager for Apache Flink](../cmf.md#cmf-flink-c3).

* Type: list
* Default: “”
* Importance: low

<a id="control-center-cmf-security"></a>

## (CMF) security settings

These Confluent Manager for Apache Flink (CMF) security settings are optional. To enable TLS for CMF, specify the following set of properties:

- `confluent.controlcenter.cmf.ssl.truststore.password`
- `confluent.controlcenter.cmf.ssl.keystore.location`
- `confluent.controlcenter.cmf.ssl.keystore.password`
- `confluent.controlcenter.cmf.ssl.key.password`
- `confluent.controlcenter.cmf.alias.name`

### confluent.controlcenter.cmf.ssl.truststore.password

The stored password for the truststore for CMF.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.cmf.ssl.keystore.location

The location of the keystore file for CMF.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.cmf.ssl.keystore.password

The store password for the keystore file for CMF.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.cmf.ssl.key.password

The password of the private key in the keystore file for CMF.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.cmf.alias.name

Specifies an alias for the certificate CMF uses during mTLS. Use the following
format to specify `<Certificate-Alias>` as an alias.

```none
confluent.controlcenter.cmf.alias.name=<Certificate-Alias>
```

If you have multiple trustStores, each certificate should have a unique alias, even if you are using the
same certificate for multiple connections.

* Type: string
* Default: “”
* Importance: low

<a id="controlcenter-ksql"></a>

<a id="controlcenter-ksql-settings"></a>

## ksqlDB

Use these settings to configure ksqlDB integration with Confluent Control Center. For more information, see [Connect ksqlDB Server Instances to Confluent Control Center on Confluent Platform](/platform/current/ksqldb/integrate-ksql-with-confluent-control-center.html#integrate-ksql-with-confluent-control-center).

## ksqlDB general settings

### confluent.controlcenter.ksql.enable

Enable user access to the [ksqlDB GUI](../ksql.md#controlcenter-userguide-ksql).

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.ksql.<ksql-cluster-name>.advertised.url

Comma-separated list of advertised URLs to access the ksqlDB cluster on
Control Center. Replace `<ksql-cluster-name>` with the name Control Center
should use to identify this ksqlDB cluster. By default, this is set to
the value specified in
`confluent.controlcenter.ksql.<ksql-cluster-name>.url`.
These hostnames must be reachable from any browser that will use the ksqlDB
web interface in Control Center.

For example, if ksqlDB is communicating over an internal DNS that is not
externally resolvable or routable (for example, if
running in Docker for Mac), then the advertised URL must be set so that the
browser can resolve the externally available
DNS that ksqlDB is available at. For more information,
see [Connect ksqlDB Server Instances to Confluent Control Center on Confluent Platform](/platform/current/ksqldb/integrate-ksql-with-confluent-control-center.html#integrate-ksql-with-confluent-control-center).

* Type: list
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.<ksql-cluster-name>.url

Comma-separated list of the ksqlDB server hostnames and listener ports for
the ksqlDB cluster specified by `<ksql-cluster-name>`. By default,
this is empty.
These hostnames must be reachable from the machine Control Center is installed
on. For more information, see
[Connect ksqlDB Server Instances to Confluent Control Center on Confluent Platform](/platform/current/ksqldb/integrate-ksql-with-confluent-control-center.html#integrate-ksql-with-confluent-control-center).

* Type: list
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.advertised.url (deprecated)

Deprecated. The advertised URL to access the ksqlDB cluster on Control Center.
By default, this is set to the value specified in
`confluent.controlcenter.ksql.url`.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.url (deprecated)

Deprecated. The ksqlDB server hostname and listener port. This is deprecated
by `confluent.controlcenter.ksql.<ksql-cluster-name>.url`.
If this deprecated configuration is supplied, then Control Center will ignore
any named ksqlDB configurations.

* Type: string
* Default: “”
* Importance: low

## ksqlDB security settings

These ksqlDB security settings are optional. To enable TLS for ksqlDB, specify the following set of properties:

- `confluent.controlcenter.ksql.ksql.ssl.truststore.location`
- `confluent.controlcenter.ksql.ksql.ssl.truststore.password`
- `confluent.controlcenter.ksql.ksql.ssl.keystore.location`
- `confluent.controlcenter.ksql.ksql.ssl.keystore.password`
- `confluent.controlcenter.ksql.ksql.ssl.key.password`
- `confluent.controlcenter.ksql.ksql.alias.name`

### confluent.controlcenter.ksql.<ksql-cluster-name>.basic.auth.user.info

Specifies the user credentials for HTTP Basic Authentication in the form of
`<username>:<password>` for ksqlDB clusters associated
with the URL fields by `<ksqldb-cluster-name>`.

* Type: string
* Default: “”
* Importance: medium

### confluent.controlcenter.ksql.ksql.ssl.truststore.location

The location of the truststore file for ksqlDB.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.ksql.ssl.truststore.password

The stored password for the truststore file for ksqlDB.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.ksql.ssl.keystore.location

The location of the keystore file for ksqlDB.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.ksql.ssl.keystore.password

The stored password for the keystore file for ksqlDB.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.ksql.ssl.key.password

The password of the private key in the keystore file for ksqlDB.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.ksql.ksql.alias.name

Specifies an alias for the certificate ksqlDB uses during mTLS. Use the following
format to specify `<Certificate-Alias>` as an alias.

```none
confluent.controlcenter.ksql.ksql.alias.name=<Certificate-Alias>
```

If you have multiple trustStores, each certificate should have a unique alias, even if you are using the
same certificate for multiple connections.

* Type: string
* Default: “”
* Importance: low

<a id="controlcenter-sr"></a>

## Schema Registry

Use these settings to configure Schema Registry integration with Confluent Control Center. For more information, see [Schema Registry Documentation](/platform/current/schema-registry/index.html) and [Enabling Multi-Cluster Schema Registry](/platform/current/control-center/topics/schema.html#multi-cluster-sr).

## Schema Registry general settings

### confluent.controlcenter.schema.registry.enable

Enable user access to [Manage Schemas in Confluent Platform](/platform/current/control-center/topics/schema.html#topicschema).

* Type: boolean
* Default: true
* Importance: low

<a id="c3-schema-registry-url"></a>

### confluent.controlcenter.schema.registry.url

Schema Registry URL. For more information and examples, see the
[Schema Registry Documentation](/platform/current/schema-registry/index.html) and
configuration steps for [Enabling Multi-Cluster Schema Registry](/platform/current/control-center/topics/schema.html#multi-cluster-sr).

* Type: list
* Default: [http://localhost:8081](http://localhost:8081)
* Importance: low

## Schema Registry security settings

These Schema Registry security settings are optional. To enable TLS for Schema Registry, specify the following set of properties:

- `confluent.controlcenter.schema.registry.schema.registry.ssl.truststore.location`
- `confluent.controlcenter.schema.registry.schema.registry.ssl.truststore.password`
- `confluent.controlcenter.schema.registry.schema.registry.ssl.keystore.location`
- `confluent.controlcenter.schema.registry.schema.registry.ssl.keystore.password`
- `confluent.controlcenter.schema.registry.schema.registry.ssl.key.password`
- `confluent.controlcenter.schema.registry.schema.registry.alias.name`

### confluent.controlcenter.schema.registry.basic.auth.credentials.source

Defines how to select the credentials for HTTP Basic Authentication header for a single Schema Registry
cluster, or the first Schema Registry in a multi-cluster Schema Registry deployment. The supported values are URL,
USER_INFO, and SASL_INHERIT.

* Type: string
* Default: URL
* Importance: medium

#### NOTE
Specifying `control.center.schema.registry.basic.auth.credentials.source`, as shown, passes `basic.auth.credentials.source` to the Schema Registry client.

### confluent.controlcenter.schema.registry.<sr-cluster-name>.basic.auth.credentials.source

Defines how to pick the credentials for HTTP Basic Authentication header on a
Schema Registry cluster in a multi-cluster Schema Registry deployment. The supported values are URL,
USER_INFO, and SASL_INHERIT.

* Type: string
* Default: URL
* Importance: medium

### confluent.controlcenter.schema.registry.basic.auth.user.info

Specifies the user credentials for HTTP Basic Authentication in the form of
`{username}:{password}` for a single Schema Registry cluster, or the first Schema Registry cluster in
a multi-cluster Schema Registry deployment.

* Type: string
* Default: “”
* Importance: medium

### confluent.controlcenter.schema.registry.<sr-cluster-name>.basic.auth.user.info

Specifies the user credentials for HTTP Basic Authentication in the form of
`<username>:<password>` for Schema Registry clusters in a multi-cluster Schema Registry deployment
(associated with the URL fields by `<sr-cluster-name>`).

* Type: string
* Default: “”
* Importance: medium

### confluent.controlcenter.schema.registry.schema.registry.ssl.truststore.location

The location of the truststore file for Schema Registry.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.schema.registry.schema.registry.ssl.truststore.password

The password for the truststore file for Schema Registry.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.schema.registry.schema.registry.ssl.keystore.location

The location of the keystore file for Schema Registry.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.schema.registry.schema.registry.ssl.keystore.password

The store password for the keystore file for Schema Registry.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.schema.registry.schema.registry.ssl.key.password

The password of the private key in the keystore file for Schema Registry.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.schema.registry.schema.registry.alias.name

Specifies an alias for the certificate Schema Registry uses during mTLS. Use the following
format to specify `<Certificate-Alias>` as an alias.

```none
confluent.controlcenter.schema.registry.schema.registry.alias.name=<Certificate-Alias>
```

If you have multiple trustStores, each certificate should have a unique alias, even if you are using the
same certificate for multiple connections.

* Type: string
* Default: “”
* Importance: low

<a id="controlcenter-connect"></a>

## Connect

Use these settings to configure Kafka Connect integration with Confluent Control Center. For more information, see [Control Center and other components](../security/authentication.md#control-center-client-basic-auth).

## Connect general settings

<a id="c3-connect-cluster-setting"></a>

### confluent.controlcenter.connect.<connect-cluster-name>.cluster

Comma-separated list of Kafka Connect worker URLs for the Connect
cluster specified by `<connect-cluster-name>`. `<connect-cluster-name>` can be an
arbitrary string used to identify individual connect clusters and does not need
to correspond to any worker setting. Control Center will connect to a
single worker. If a worker fails, Control Center will try the request against a
different worker. This must be set if you want to manage a
Connect cluster. The URL should include the protocol (HTTP or HTTPS) and
its associated port (8083 or 8443 respectively).

* Type: list
* Default: “”
* Importance: high
* Example HTTP: `confluent.controlcenter.connect.myconnectclustername.cluster=http://localhost:8083`

### confluent.controlcenter.connect.healthcheck.endpoint

Provides the default discovery path for connect clusters.
If you are using the community version of Confluent Platform,
set this property to `/connectors` to display the connect clusters in Control Center.

* Type: string
* Default: /v1/metadata/id
* Importance: high

### confluent.controlcenter.connect.cluster (deprecated)

Deprecated since Confluent Platform version `6.2`. Comma-separated list of Connect worker URLs within a single
cluster. This is deprecated by `confluent.controlcenter.connect.<connect-cluster-name>.cluster`.

* Type: list
* Default: “”
* Importance: low

## Connect security settings

These Connect security settings are optional. To enable TLS for Connect, specify the following set of properties:

- `confluent.controlcenter.connect.connect.ssl.truststore.location`
- `confluent.controlcenter.connect.connect.ssl.truststore.password`
- `confluent.controlcenter.connect.connect.ssl.keystore.location`
- `confluent.controlcenter.connect.connect.ssl.keystore.password`
- `confluent.controlcenter.connect.connect.ssl.key.password`
- `confluent.controlcenter.connect.connect.alias.name`

### confluent.controlcenter.connect.<connect-cluster-name>.basic.auth.user.info

Specifies the user credentials for Control Center to communicate with a Connect cluster
configured for HTTP Basic Authentication. The name of the Connect cluster appears in the configuration
(`<connect-cluster-name>`) and credentials use this form: `<username>:<password>`

Without this configuration for Connect clusters using HTTP Basic Authentication, Control Center
cannot display Connectors in the cluster. For more information, see [Control Center and other components](../security/authentication.md#control-center-client-basic-auth).

* Type: string
* Default: “”
* Importance: medium

### confluent.controlcenter.connect.connect.ssl.truststore.location

The location of the truststore file for Connect.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.connect.connect.ssl.truststore.password

The stored password for the truststore for Connect.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.connect.connect.ssl.keystore.location

The location of the keystore file for Connect.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.connect.connect.ssl.keystore.password

The store password for the keystore file for Connect.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.connect.connect.ssl.key.password

The password of the private key in the keystore file for Connect.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.connect.connect.alias.name

Specifies an alias for the certificate Connect uses during mTLS. Use the following
format to specify `<Certificate-Alias>` as an alias.

```none
confluent.controlcenter.connect.connect.alias.name=<Certificate-Alias>
```

If you have multiple trustStores, each certificate should have a unique alias, even if you are using the
same certificate for multiple connections.

* Type: string
* Default: “”
* Importance: low

<a id="c3-rbac-settings"></a>

## RBAC

Metadata Service (MDS) and other optional settings required for implementing RBAC in
Control Center. For a complete configuration example of essential settings,
see [Configure RBAC for Control Center on Confluent Platform](../security/c3-rbac.md#controlcenter-security-rbac).

### confluent.metadata.bootstrap.server.urls

A comma-separated list of valid URLs that specify where the RBAC metadata
server or servers can be reached. This configuration is required to
run Control Center inside an RBAC environment.

* Type: long
* Default: 0
* Importance: low

### confluent.metadata.basic.auth.user.info

Formatted as `USERNAME:PASSWORD`, the credentials of an RBAC user for
Control Center to act on behalf of. This includes running Kafka Streams,
authorizing requests, and interacting with other Confluent Platform services. This
configuration is required to run Control Center inside an RBAC environment.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.auth.bearer.issuer

JWT token issuer.

* Type: string
* Default: “”
* Importance: low

### public.key.path

Path to public key for authenticating JWT tokens.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.auth.bearer.roles.claim

JWT roles claim.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.mds.client.max.requests.queued.per.destination

The number of requests that can be queued for the Control Center MDS client used with RBAC.
You can increase this property value to increase queue capacity, but you should not lower the value.

* Type: int
* Default: 1024
* Importance: low

### confluent.controlcenter.mds.client.idle.timeout

The number of milliseconds before an idle connection to the Control Center MDS client used
with RBAC times out. You can reduce this property value
to help reduce the number connections left in a `CLOSE_WAIT` state.

* Type: int
* Default: 30000
* Importance: low

### confluent.controlcenter.auth.bearer.token.max.lifetime.ms

Bearer token issued during login cannot renew itself beyond this duration. In a
deployment that uses RBAC with bearer-token authentication,
`confluent.controlcenter.auth.bearer.token.max.lifetime.ms` determines how
long a login session can last before the user must log in again, and you must
set it to a value less than 24 hours and greater than or equal to the value of
the Metadata Service (MDS) property `confluent.metadata.server.token.max.lifetime.ms`.

- If you set this to more than 24 hours, the system overrides your setting and uses 24 hours.
- If you set this value to a value less than the value defined by the Metadata Service (MDS) property
  `confluent.metadata.server.token.max.lifetime.ms`, the value you set for
  `confluent.controlcenter.auth.bearer.token.max.lifetime.ms` is ignored. For more
  information, see [Configuration](/platform/current/kafka/configure-mds/mds-configuration.html#mds-property-token-max-lifetime-ms).

Maximum value: 86400000 (24 hours)

* Type: long
* Default: 21,600,000 (6 hours)
* Importance: low

<a id="c3-rbac-scope-fetch-parallelism"></a>

### confluent.controlcenter.rbac.scope.fetch.parallelism

The maximum number of per-cluster RBAC scope fetches that Control Center
performs in parallel when it resolves Metadata Service (MDS) visibility for your Connect,
ksqlDB, and Schema Registry clusters. This configuration is available in Control Center
2.6.0 and later.

When RBAC is enabled and you have many Connect, ksqlDB, or Schema Registry clusters
configured, Control Center fetches the RBAC scope for each cluster to determine
which clusters you can see. Fetching these scopes in parallel reduces the
total time spent waiting on slow or unreachable clusters, which prevents your
session token from expiring mid-request and surfacing a misleading
`failed to connect to any MDS server` error.

For most deployments, the default of `10` is sufficient. If you have more
than 10 slow or unreachable clusters and still see `failed to connect to any
MDS server` errors, increase this value to at least the number of slow
clusters (for example, try `20`, then `30`). Setting this value higher
than the total number of Connect, ksqlDB, and Schema Registry clusters that you have
configured provides no benefit. For more information, see
[Failed to connect to any MDS server](troubleshooting.md#c3-failed-to-connect-mds).

* Type: int
* Default: 10
* Importance: medium

<a id="cluster-registry-settings"></a>

## Cluster Registry

Version 6.0.1 of Confluent Platform and later includes optional settings to enable the [Cluster Registry in Confluent Platform](/platform/current/security/cluster-registry.html#cluster-registry) for
Control Center, which creates a more user-friendly RBAC role binding experience and
enables centralized audit logging.

### confluent.metadata.cluster.registry.enable

The value for this flag is **True** if the cluster registry is enabled. When enabled,
cluster information will be read from the cluster registry.

* Type: boolean
* Default: false

#### NOTE
If this feature flag is enabled, the following flags will be ignored:

- `confluent.controlcenter.kafka.<name>.bootstrap.servers`
- `confluent.controlcenter.kafka.<name>.<connection config>`

An exception to this rule occurs when you need to specify additional
flags, such as `confluent.controlcenter.kafka.<name>.ssl.keystore.location`.

### confluent.metadata.cluster.registry.merge.configuration.enable

When enabled, the configuration information for Kafka clusters in the properties
file is merged with the one from cluster registry. This enables users to configure
additional properties that cannot be added to cluster registry (for example,
`confluent.controlcenter.kafka.<name>.ssl.keystore.location`).

* Type: boolean
* Default: true

### confluent.controlcenter.purge.stale.cluster.enable

When enabled, Control Center will purge stale cluster information from the command
store.

* Type: boolean
* Default: false

<a id="single-store"></a>

## Single Proxy Server Store

Instead of specifying TLS settings for each component, you have the option to specify that Confluent Control Center
use a single proxy server truststore and keystore that contain all the TLS settings for all the components.

### confluent.controlcenter.rest.proxy.ssl.truststore.location

The location of the the truststore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.rest.proxy.ssl.truststore.password

The stored password for the truststore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.rest.proxy.ssl.keystore.location

The location of the keystore file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.rest.proxy.ssl.keystore.password

The stored password for the password file.

* Type: string
* Default: “”
* Importance: low

### confluent.controlcenter.rest.proxy.ssl.key.password

The password of the private key in the keystore file.

* Type: string
* Default: “”
* Importance: low

## Other feature enable/disable settings

These optional settings enable Confluent Control Center features such as message
inspection, broker configurations, license manager, and other UI features. They apply to all clusters managed by the
current Control Center installation. Most features are enabled by default except
the deprecated views for legacy System Health and Streams Monitoring.

<!-- Health+ will have a default false value ^ -->

### confluent.controlcenter.topic.inspection.enable

Enable users to [inspect topics](../topics/messages.md#c3-topic-message-browser).

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.broker.config.edit.enable

Enable user access to [Edit dynamic cluster configuration settings](../clusters.md#edit-broker-config).

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.license.manager.enable

Enable [License Manager](license.md#controlcenter-licenses) in Control Center.

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.consumers.view.enable

Enable the [Consumers](../clients/consumers.md#controlcenter-userguide-consumers) view in
Control Center.

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.ui.autoupdate.enable

Enable [auto updating](auto-update-ui.md#c3-auto-update-ui) the Control Center UI.

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.usage.data.collection.enable

Data collection is disabled, and this property has no effect regardless of its value.
Enable or disable data collection in
Control Center.

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.ui.replicator.monitoring.enable

Enable [Replicator monitoring](../replicators.md#controlcenter-userguide-replicators) in the Control Center UI.

* Type: boolean
* Default: true
* Importance: low

### confluent.controlcenter.ui.controller.chart.enable

Enable the Active Controller chart to display within the
[Broker uptime panel](../brokers.md#c3-broker-zookeper-metric)
in the Control Center UI.

* Type: boolean
* Default: false
* Importance: low

<a id="internal-streams-settings"></a>

## Internal Kafka Streams settings

Because Control Center reads and writes data to Kafka, you are allowed to change some optional settings for
producer and consumer configurations.

Some examples of values used internally are
given. These settings map 1:1 with producer/consumer configs used internally by
Control Center and all use the
prefix `confluent.controlcenter.streams.{producer,consumer}.`.

### confluent.controlcenter.streams.ssl.cipher.suites

A list of cipher suites. This is a named combination of authentication,
encryption, MAC and key exchange algorithm used to negotiate the security
settings for a network connection using TLS. By default, all of the
available cipher suites are supported.

* Type: list
* Default: null
* Importance: low

### confluent.controlcenter.streams.ssl.enabled.protocols

The comma-separated list of protocols enabled for TLS connections. The default
value is `TLSv1.2,TLSv1.3` when running with Java 11 or later, `TLSv1.2`
otherwise. With the default value for Java 11 (`TLSv1.2,TLSv1.3`), Kafka
clients and brokers prefer TLSv1.3 if both support it, and falls back to
TLSv1.2 otherwise (assuming both support at least TLSv1.2).

* Type: list
* Default: `TLSv1.2,TLSv1.3`
* Importance: medium

## Internal topics settings

This setting is optional.

Besides the command topic described below, Control Center uses internal
topics to store alerts, cluster metadata, and other data.

### confluent.controlcenter.internal.topics.replication

Replication factor used internally by Control Center for its internal topics.

#### IMPORTANT
This value must not be greater than the number of brokers
available in the Kafka cluster. If the configured replication factor is
greater than the number of available brokers, Control Center fails to
start with an error like `N brokers are required but only found
M`. Reducing the replication value is not recommended, except in a
development environment.

* Type: int
* Default: 3
* Importance: low

## Internal command settings

These settings are optional.

The command topic is used to store internal configuration data for Control Center.

#### NOTE
For multiple instances of Control Center using the same Kafka cluster for monitoring
purposes, it may be helpful to use separate metrics and command topics (if each
Control Center installation is monitoring different Kafka clusters).

The command topic reuses the defaults/overrides for
[Kafka Streams](/platform/current/streams/developer-guide/config-streams.html#streams-developer-guide-configuration), but allows the
following overrides.

### confluent.controlcenter.command.topic

Topic used to store Control Center configuration.

* Type: string
* Default: \_confluent-command
* Importance: low

### confluent.controlcenter.command.topic.replication

Replication factor for command topic.

#### IMPORTANT
Reducing the replication value is not recommended, except in
a development environment.

* Type: int
* Default: 3
* Importance: low

### confluent.controlcenter.command.topic.retention.ms

Maximum time in milliseconds that command data is stored in Kafka.

* Type: long
* Default: 86,400,000 (1 day)
* Importance: low

## Consumer Group settings

This setting is optional.

If you find that the Consumer Group page is not returning data, you can
change the timeout value for the page. The default value is 15 seconds (or
15000 milliseconds); try increasing the value to 30 seconds (30000 milliseconds)
if you are having timeout issues.

### confluent.controlcenter.consumer.metadata.timeout.ms

Time to wait when attempting to retrieve Consumer Group metadata.

* Type: int
* Default: 15,000
* Importance: low

## Related content

- For details on configuring authentication, see the [Configure HTTP Basic Authentication with Control Center on Confluent Platform](../security/authentication.md#ui-authentication) guide.
- To configure TLS settings when Control Center acts as a proxy server to other Confluent Platform components, see [Configure TLS for Control Center on Confluent Platform](../security/ssl.md#controlcenter-security-ssl).