# Mutual TLS (mTLS) — Kafka credentials. The client authenticates with a
# certificate (distinct from unauthenticated_tls, which is one-way/server-only).
#
# Usable in any Kafka slot (source, clusterLink.source, clusterLink.destination).
mtls:
  client_cert: ./client.pem   # required — client certificate (PEM)
  client_key: ./client.key    # required — client private key (PEM)
  # ca_cert: ./ca.pem         # optional — PEM to verify the broker's cert
                              # (private/internal CA); omit for a public-CA broker.