The configuration of the canary's TLS_CA_CERT environment variable is fixed to use the CA secret provided by Strimzi [1]. When a TLS certificate and key are provided by the control plane, the TLS certificate should instead be the trusted cert since it is the one that will be used by the external Kafka listener used by the canary.

[1] https://github.com/bf2fc6cc711aee1a0c2a/kas-fleetshard/blob/b649c685b5166fba67bc6386dc8a735309ac63d3/operator/src/main/java/org/bf2/operator/operands/Canary.java#L177-L182