# Unauthenticated one-way TLS — Kafka credentials. Encrypted, but the client is
# not authenticated (the server presents a cert; the client does not).
#
# Usable in any Kafka slot (source, clusterLink.source, clusterLink.destination).
unauthenticated_tls:
  ca_cert: ./ca.pem   # PEM to verify a private/internal CA.
# For a public-CA broker, use an empty block instead (its presence selects the method):
#   unauthenticated_tls: {}