# Configuring SSL Elasticsearch 3 node cluster **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 11, 2020, 11:14am UTC](https://discuss.elastic.co/t/configuring-ssl-elasticsearch-3-node-cluster/231988 "2020-05-11T11:14:06Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Post date:** [May 11, 2020, 11:14am UTC](https://discuss.elastic.co/t/configuring-ssl-elasticsearch-3-node-cluster/231988/1 "2020-05-11T11:14:07Z")
Hello Team, We have 3 node cluster as followes 3 Master-eligible nodes - node1,node2,node3 3 Data nodes - node1,node2,node3 Kibana is running on node3 We have to configure SSL in to make the communication secure. I have followed the given steps in this blog : [https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication](http://blog). we have generated **.key .cer** files for all 3 nodes,now how to create a single singed CA file to trust all nodes certificates is my doubt Another question is how to create a Client certificate , that is for Kibana ? I have gone through several documents and blogs but couldn't find 3 node cluster with HTTPS . Please give me detailed explanation if possible with the steps!! Thanks, Ramya ---
**Author:** ![hunsw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunsw/32/93637_2.png) [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Post date:** [May 12, 2020, 7:30am UTC](https://discuss.elastic.co/t/configuring-ssl-elasticsearch-3-node-cluster/231988/2 "2020-05-12T07:30:10Z")
We are using a different product for security, but it seems the linked page ([https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication](https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication)) has the answer to your question. With ```auto bin/elasticsearch-certutil ca ``` you generate a certificate authority (CA) certificate, by default it is stored (along with its key) in elastic-stack-ca.p12 . If you need a pem version, issue ```auto bin/elasticsearch-certutil ca -pem ``` instead, this will get you a zip file with the certificate (ca.crt) and the key (ca.key) file. When configuring the nodes and Kibana, you can use the above ca.crt (or extract the cert from the p12 container with openssl, e.g. ```auto openssl pkcs12 -in elastic-stack-ca.p12 -out elastic-stack-ca.crt.pem -clcerts -nokeys ``` ---
**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Post date:** [May 13, 2020, 8:41am UTC](https://discuss.elastic.co/t/configuring-ssl-elasticsearch-3-node-cluster/231988/3 "2020-05-13T08:41:41Z")
Hi hunsw, Thanks for your reply. I am looking for how to generate signed CA certificate. Thanks, Ramya ---
**Author:** ![hunsw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hunsw/32/93637_2.png) [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Post date:** [May 13, 2020, 3:08pm UTC](https://discuss.elastic.co/t/configuring-ssl-elasticsearch-3-node-cluster/231988/4 "2020-05-13T15:08:32Z")
Here's a superb guide to set up your CA: [https://jamielinux.com/docs/openssl-certificate-authority/](https://jamielinux.com/docs/openssl-certificate-authority/) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 10, 2020, 3:08pm UTC](https://discuss.elastic.co/t/configuring-ssl-elasticsearch-3-node-cluster/231988/5 "2020-06-10T15:08:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.