# mTLS Authentication for Confluent Control Center Monitoring and Alerting Confluent Control Center internally integrates with Prometheus and Alertmanager to deliver its comprehensive monitoring and alerting functionalities, processing relevant data from sources such as broker/KRaft controller metrics. This section describes how to configure mTLS for secure communication among Kafka broker, Confluent Control Center, Prometheus, and the Alertmanager. #### NOTE This mTLS configuration is supported for Confluent Control Center with Confluent Platform versions 7.9.1 and later. ## Certificate configuration For mTLS setup Confluent Platform requires these certificates: - an SSL certificate - an SSL Key - a root CA certificate (this can be self-signed) 1. Update the corresponding certificate details in these configuration files. For Prometheus update: : `/etc/confluent-control-center/web-config-prom.yml` For Alertmanager update: : `/etc/confluent-control-center/web-config-am.yml` The configuration should appear as follows: ```yaml tls_server_config: cert_file: /home/prometheus/certs/example.com/example.com.crt key_file: /home/prometheus/certs/example.com/example.com.key client_ca_file: /path/to/ca.crt min_version: TLS12 client_auth_type: RequireAndVerifyClientCert ``` 2. Start and restart Prometheus. ```bash systemctl enable prometheus systemctl start prometheus ``` 3. Start and restart Alertmanager. ```bash systemctl enable alertmanager systemctl start alertmanager ``` 4. Test your certificate configuration with the following `curl` command: ```bash curl --cacert {path_to_ca_certificate} \ --cert {path_to_client_certificate} \ --key {path_to_client_key} \ https://{prometheus-url}:9090/api/v1/label/job/values ``` A successful command returns the following: ```bash {"status":"success","data":["prometheus"]} ``` ## Configure Confluent Control Center, brokers, controllers, Prometheus, and Alertmanager In this section, you update configurations in the Confluent Control Center broker and KRaft controller files to support secure communicate with Prometheus and Alertmanager. You also configure metrics in Prometheus. 1. Update the Confluent Control Center properties file with the following configuration: ```none confluent.controlcenter.prometheus.enable=true confluent.controlcenter.prometheus.url=https://localhost:9090 confluent.controlcenter.prometheus.rules.file=/etc/confluent-control-center/trigger_rules-generated.yml confluent.controlcenter.alertmanager.url=https://localhost:9093 confluent.controlcenter.alertmanager.config.file=/etc/confluent-control-center/alertmanager-generated.yml #Prometheus mTLS config confluent.controlcenter.prometheus.ssl.truststore.location= confluent.controlcenter.prometheus.ssl.truststore.password= confluent.controlcenter.prometheus.alias.name= confluent.controlcenter.prometheus.ssl.key.password= confluent.controlcenter.prometheus.ssl.keystore.location= confluent.controlcenter.prometheus.ssl.keystore.password= confluent.controlcenter.prometheus.basic.auth.user.info=: #Alertmanager mTLS Config confluent.controlcenter.alertmanager.alias.name= confluent.controlcenter.alertmanager.ssl.truststore.location= confluent.controlcenter.alertmanager.ssl.truststore.password= confluent.controlcenter.alertmanager.ssl.key.password= confluent.controlcenter.alertmanager.ssl.keystore.location= confluent.controlcenter.alertmanager.ssl.keystore.password= confluent.controlcenter.alertmanager.basic.auth.user.info=: ``` For detailed instructions on these and other required properties and more, see [Enable mTLS in Kafka](/platform/current/security/authorization/rbac/configure-mtls-rbac.html#enable-mtls-in-ak). 2. Configure the broker and KRaft controllers to emit metrics to Prometheus. ```none confluent.metrics.reporter.security.protocol=SSL confluent.metrics.reporter.ssl.key.password= confluent.metrics.reporter.ssl.keystore.location= confluent.metrics.reporter.ssl.keystore.password= confluent.metrics.reporter.ssl.truststore.location= confluent.metrics.reporter.ssl.truststore.password= ``` 3. Update the `/etc/confluent-control-center/prometheus-generated.yml` configuration file in Prometheus to send alerts to Alertmanager. ```yaml alerting: alertmanagers: - scheme: https static_configs: - targets: - :9093 tls_config: ca_file: cert_file: key_file: ```