# After having xpack security in place in elasticsearch cluster, cluster not working as expected

**URL:** <https://discuss.elastic.co/t/after-having-xpack-security-in-place-in-elasticsearch-cluster-cluster-not-working-as-expected/172106>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 13, 2019, 9:51am UTC](https://discuss.elastic.co/t/after-having-xpack-security-in-place-in-elasticsearch-cluster-cluster-not-working-as-expected/172106 "2019-03-13T09:51:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![surender](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@surender](https://discuss.elastic.co/u/surender)\
**Post date:** [March 13, 2019, 9:51am UTC](https://discuss.elastic.co/t/after-having-xpack-security-in-place-in-elasticsearch-cluster-cluster-not-working-as-expected/172106/1 "2019-03-13T09:51:39Z")

</div>

Initially deployed elasticsearch cluster with 3 nodes and it was started properly and working.

I want to encrypt communication between nodes and between clients and clusters.

configured TLS and http encrypted in the cluster then cluster not working as expected. getting below errors. Please check and help.

below are the entries from elasticsearch.yml file using

xpack.security.enabled: true  
xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.verification\_mode: certificate  
xpack.security.transport.ssl.keystore.path: certs/cert.p12  
xpack.security.transport.ssl.truststore.path: certs/cert.p12  
xpack.security.http.ssl.enabled: true  
xpack.security.http.ssl.keystore.path: certs/cert.p12  
xpack.security.http.ssl.truststore.path: certs/cert.p12  
xpack.security.http.ssl.client\_authentication: optional  
xpack.security.authc.realms.pki1.type: pki  
xpack.security.authc.accept\_default\_password: false

error from journal log:

polkitd[567]: Unregistered Authentication Agent for unix-processl log :

from elasticcluster log :

Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 474554202f5f636c75737465722f73746174653f70726574747920485454502f312e310d0a557365722d4167656e743a206375726c2f372e32392e300d0a486f73743a2031302e3132392e3139352e3134393a393230300d0a4163636570743a202a

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 13, 2019, 2:12pm UTC](https://discuss.elastic.co/t/after-having-xpack-security-in-place-in-elasticsearch-cluster-cluster-not-working-as-expected/172106/2 "2019-03-13T14:12:26Z")

</div>

Hi there,

> then cluster not working as expected

You need to give us more details. What doesn't work as expected ?

> below are the entries from elasticsearch.yml file using

You have also enabled the PKI realm for authentication. This means that every request to Elasticsearch on the http layer needs to be over TLS with client authentication. Is that what you want to achieve? Our PKI realm docs are here : [PKI user authentication | Elastic Stack Overview [7.4] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/current/pki-realm.html)

> from elasticcluster log :

> Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 474554202f5f636c75737465722f73746174653f70726574747920485454502f312e310d0a557365722d4167656e743a206375726c2f372e32392e300d0a486f73743a2031302e3132392e3139352e3134393a393230300d0a4163636570743a202a

This is not the cause of the problem. What you are seeing there is Elasticsearch logging that while it is configured to only accept connections on the http layer over TLS ( you have configured it as such with `xpack.security.http.ssl.enabled: true` ), it received a connection over plain http. In fact that long HEX string decodes to :

```auto
GET /_cluster/state?pretty HTTP/1.1
User-Agent: curl/7.29.0
Host: 10.129.195.149:9200
Accept: *

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2019, 2:12pm UTC](https://discuss.elastic.co/t/after-having-xpack-security-in-place-in-elasticsearch-cluster-cluster-not-working-as-expected/172106/3 "2019-04-10T14:12:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.