Not sure where I found the docs, but it comes down to adding the config three times:
# SSL configuration for Kafka client
security.protocol=SSL
ssl.keystore.location=***
ssl.keystore.password=***
ssl.truststore.location=***
ssl.truststore.password=***
# SSL configuration for Kafka producer
producer.security.protocol=SSL
producer.ssl.keystore.location=***
producer.ssl.keystore.password=***
producer.ssl.truststore.location=***
producer.ssl.truststore.password=***
# SSL configuration for Kafka consumer
consumer.security.protocol=SSL
consumer.ssl.keystore.location=***
consumer.ssl.keystore.password=***
consumer.ssl.truststore.location=***
consumer.ssl.truststore.password=***