We currently support TLS connections with a CA certificate to verify broker identities.

However, we do not support client certificates for mutual auth. This is an alternative to SASL authentication.
Adding the client cert/key to the tls.Config.Certificate field should be sufficient. See example of this used by cockroach clients.

In single listener configurations (something that is not easily changed with some orchestrations), it is not possible to mix TLS client auth and SASL. This means that an existing kafka broker with TLS auth for other clients cannot be used by CHANGEFEED until we support client certificates.

CC: @rolandcrosby