# Cannot establish secure (SSL/TLS) connection between elasticsearch clusters **URL:** \ **Category:** Elasticsearch\ **Tags:** ccs-cross-cluster-search\ **Created:** [March 26, 2019, 3:34am UTC](https://discuss.elastic.co/t/cannot-establish-secure-ssl-tls-connection-between-elasticsearch-clusters/173852 "2019-03-26T03:34:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![iShiBin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishibin/32/32602_2.png) [@iShiBin](https://discuss.elastic.co/u/iShiBin)\ **Post date:** [March 26, 2019, 3:34am UTC](https://discuss.elastic.co/t/cannot-establish-secure-ssl-tls-connection-between-elasticsearch-clusters/173852/1 "2019-03-26T03:34:16Z")
Hi, I followed the guide on [Elastic website](https://www.elastic.co/guide/en/x-pack/current/cross-cluster-configuring.html) "Adding the CA certificate from the local cluster as a trusted CA in each remote cluster (see [Transport TLS settings](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/security-settings.html#transport-tls-ssl-settings))." However, I found the connection could not be made. Maybe it is because both of my local and remote clusters are using SSL. After I applied the CA to each coordinator and gateway nodes, they can be connected. Is this the right way to do this? If positive, will you please update your documentation as well? ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [March 26, 2019, 10:42am UTC](https://discuss.elastic.co/t/cannot-establish-secure-ssl-tls-connection-between-elasticsearch-clusters/173852/2 "2019-03-26T10:42:56Z")
Hi @iShiBin, First up, the docs you linked are for version 6.2. The latest version of this information is [in the Elastic Stack docs here](https://www.elastic.co/guide/en/elastic-stack-overview/current/cross-cluster-configuring.html). However I don't see any major differences in the section you're talking about. It's certainly possible to set up cross-cluster search with TLS enabled everywhere. Can you explain a bit more precisely where you got stuck? When you say "the CA" what do you mean? Do you have one CA shared by both clusters, or does each cluster have its own CA? What do you mean by "applied"? Can you share the commands you used to do this? I tried following the docs myself and I did get stuck in two places: - the trust relationship actually needs to be bidirectional. Each cluster needs to trust the other cluster's CA. - I did not know how to add a CA certificate as a trusted CA in another cluster. I think we can improve the docs in this area. ---
**Author:** ![iShiBin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ishibin/32/32602_2.png) [@iShiBin](https://discuss.elastic.co/u/iShiBin)\ **Post date:** [March 26, 2019, 4:14pm UTC](https://discuss.elastic.co/t/cannot-establish-secure-ssl-tls-connection-between-elasticsearch-clusters/173852/3 "2019-03-26T16:14:46Z")
Here are my answers to your questions: > Can you explain a bit more precisely where you got stuck? After I import the local CA file (ca.pem) in the remote cluster, I cannot send query the data from the coordinator node in the local cluster. Then when I tried to restart this coordinator, I got Java exceptions attached as below. > Caused by: java.lang.IllegalStateException: failed to connect to remote clusters > at org.elasticsearch.transport.RemoteClusterService.initializeRemoteClusters(RemoteClusterService.java:340) ~[elasticsearch-6.2.4.jar:6.2.4] > at org.elasticsearch.transport.TransportService.doStart(TransportService.java:231) ~[elasticsearch-6.2.4.jar:6.2.4] > at org.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:66) ~[elasticsearch-6.2.4.jar:6.2.4] > When you say "the CA" what do you mean? I mean the CA PEM file. > Do you have one CA shared by both clusters, or does each cluster have its own CA? Each cluster has its own CA file. And I don't think the CA needs to be imported/applied if they use the same one. > What do you mean by "applied"? I mean import to the key store. In addition, I think you get my point here: **the trust relationship actually needs to be bidirectional. Each cluster needs to trust the other cluster's CA** (if they don't use/share the same CA.) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 23, 2019, 4:14pm UTC](https://discuss.elastic.co/t/cannot-establish-secure-ssl-tls-connection-between-elasticsearch-clusters/173852/4 "2019-04-23T16:14:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.