# Appsearch on unsecure cluster

**URL:** <https://discuss.elastic.co/t/appsearch-on-unsecure-cluster/307644>\
**Category:** Elastic Search\
**Tags:** elastic-app-search\
**Created:** [June 20, 2022, 11:57am UTC](https://discuss.elastic.co/t/appsearch-on-unsecure-cluster/307644 "2022-06-20T11:57:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [June 20, 2022, 11:57am UTC](https://discuss.elastic.co/t/appsearch-on-unsecure-cluster/307644/1 "2022-06-20T11:57:33Z")

</div>

Hi

I am trying to set up an unsecured cluster (without auth and TLS) with Appsearch - I can set up an unsecure ES cluster by turning off security in the elasticsearch.yml file using:

```auto
xpack.security.enabled: false
xpack.security.transport.ssl.enabled: false
xpack.security.http.ssl.enabled: false

```

but I get an error saying I need to set my encryption key in Appsearch so I updated enterprise-search.yml and added the following line

```auto
secret_management.encryption_keys: [<my key string here>]

```

Next, I got an error saying

```auto
Elasticsearch API key service must be enabled. It is enabled automatically when you configure Elasticsearch to use TLS on the HTTP interface.
Alternatively, you can explicitly enable the setting within Elasticsearch by opening config/elasticsearch.yml and adding:

xpack.security.authc.api_key.enabled: true

```

Now, when I go back to elasticsearch.yml and add this line, it starts up fine but Appsearch still keeps throwing the same error

I am assuming it's because **xpack.security** is disabled already so this line doesn't work

I am curious now if it is at all possible to run Appsearch in an unsecure cluster (my cluster is inside a VPC which is secured so I don't need to run it in secure mode)

BR

---

<div class="post-metadata">

**Author:** ![Sean\_Story](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sean_story/32/69987_2.png) [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\
**Post date:** [June 21, 2022, 7:11pm UTC](https://discuss.elastic.co/t/appsearch-on-unsecure-cluster/307644/2 "2022-06-21T19:11:38Z")

</div>

Hi @samiujan ,

This is an interesting intersection of configuration between Enterprise Search and Elasticsearch.

Elasticsearch does need to have `xpack.security.enabled=true` in order for `xpack.security.authc.api_key.enabled=true` to be respected. And Enterprise Search does need to be able to use API Keys in order to communicate with Elasticsearch. Typically, this would imply that you need to set up SSL for Elasticsearch, as it doesn't make a lot of sense to have `xpack.security.enabled=true` and then to ignore what actually makes the cluster secure.

However, you're not alone in this usecase. One way to disable this "production" check is to signal to Elasticsearch that this is not a production cluster. If you set `discovery.type=single-node` and only have a single Elasticsearch node, you effectively tell Elasticsearch to allow you to run with non-production settings without error, which allows you to enable security without configuring SSL.

Another way to signal that this is not a production environment is to use a Trial License. These do expire, so they are not a good long-term workaround.

You can read more about this here: [Bootstrap Checks | Elasticsearch Guide [8.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html) and here: [Bootstrap Checks for X-Pack | Elasticsearch Guide [8.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks-xpack.html#bootstrap-checks-tls)

The final, and best workaround, of course, is to use TLS, regardless of your VPC setup. We recommend always using encryption, and not expecting that one layer of security removes the need for other layers. You can create yourself a self-signed certificate for free. You could also consider using [Elastic Cloud](https://cloud.elastic.co) to manage your deployment, as it provides TLS out-of-the-box without any extra work needed on your end.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2022, 7:12pm UTC](https://discuss.elastic.co/t/appsearch-on-unsecure-cluster/307644/3 "2022-07-19T19:12:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.