---
title: Couchbase Capella Support
pubDate: 2026-08-17T09:53:44.266Z
antora:
  editUrl: https://github.com/couchbase/docs-kafka/edit/release/4.3/modules/ROOT/pages/cloud.adoc
  xref: xref:kafka-connector::cloud.adoc[]
---

[Consult the llms.txt file for a full list of contents](/llms.txt)
[View original HTML](/kafka-connector/current/cloud.html)

# Couchbase Capella Support

> Connecting to Couchbase Capella is very similar to connecting to any Couchbase cluster over an encrypted connection. This section explains how. 

> [!IMPORTANT]
> You must use a Kafka connector version of **4.0.1 or higher**. Earlier versions will not work.

## [](#before-you-start)Before You Start

Make sure your Capella cluster is configured to allow connections from the IP addresses of all computers running the connector.

You will need the credentials of a Capella database user. For the source connector, the user must have read (or read/write) permission. For the sink connector, the user must have read/write permission.

You will need to know which version of the connector you are using, so you can follow the instructions for that version.

## [](#configure-4.1.7)Configuring Version 4.1.7 and Later

With this version of the connector, connecting to Capella is simple. All you need to do is enable TLS by setting the `couchbase.enable.tls` connector config property to true.

The Capella Certificate Authority (CA) certificate bundled with the connector is trusted by default. **You can skip the rest of this page**, or continue reading to learn how to configure the connector to trust a different CA certificate.

## [](#certificate-download)Certificate Download

Once you have created a Cluster in Couchbase Capella, navigate to the `Connect` tab and download the security certificate.

![Cloud UI](_images/cloud-ui.png) 

Rename the downloaded file to `couchbase.pem`. (The name doesn't really matter, but the rest of this guide refers to the Couchbase certificate file by that name.)

## [](#connector-config)Configuring Version 4.0.5 and Later

Enable TLS by setting `**couchbase.enable.tls**` to `true`.

Set the `**couchbase.trust.certificate.path**` property to the absolute filesystem path to `couchbase.pem`.

Now you're ready to connect to your Couchbase Capella cluster.

> [!TIP]
> Alternatively, you can put the certificate in a trust store as decribed in the next section.

## [](#trust-store)Configuring Earlier Versions

Prior to connector version 4.0.5, the certificate must live in a trust store.

### [](#add-the-certificate-to-a-trust-store)Add the certificate to a trust store

The connector's trust store is a Java keystore file containing the certificates the connector should trust. We'll use the Java `keytool` command to create a keystore and populate it with the root certificates for Couchbase Capella.

To add the Couchbase Capella root certificate:

```none
$ keytool -importcert -keystore truststore.jks -file couchbase.pem
```

If the keystore file `truststore.jks` does not yet exist, you will be prompted to choose a password for the new keystore. Otherwise, you will be prompted for the password of the existing keystore.

You will then be presented with a summary of the information in the certificate, and asked if you want to trust the certificate. If the information is correct, enter `y` to confirm.

You can verify that it has been stored with `keytool -list`:

```none
$ keytool -list
Enter keystore password:
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry
```

### [](#configure-the-connector-to-use-a-trust-store)Configure the connector to use a trust store

Now that you have a trust store containing the Capella certificate, the last step is to configure the connector to use it for secure connections.

Enable TLS by setting `**couchbase.enable.tls**` to `true`.

Set the `**couchbase.trust.store.path**` property to the absolute filesystem path to `truststore.jks`.

Configure `**couchbase.trust.store.password**` by providing the keystore password.

Now you're ready to connect to your Couchbase Capella cluster.