The Kafka certs are required by the Kafka consumer which run as part of the Pinot server. Hence, the certificates should be installed into a location which is accessible by the Pinot server. The path itself does not matter as these are controlled by the properties
ssl.truststore.location
and
ssl.keystore.location
when connecting to a Kafka cluster.