# Configuring the Transport Client to work with a Secured Cluster

**URL:** <https://discuss.elastic.co/t/configuring-the-transport-client-to-work-with-a-secured-cluster/296476>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 7, 2022, 1:40pm UTC](https://discuss.elastic.co/t/configuring-the-transport-client-to-work-with-a-secured-cluster/296476 "2022-02-07T13:40:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [February 7, 2022, 1:40pm UTC](https://discuss.elastic.co/t/configuring-the-transport-client-to-work-with-a-secured-cluster/296476/1 "2022-02-07T13:40:36Z")

</div>

hey there,  
following this [doc page](https://www.elastic.co/guide/en/elasticsearch/reference/7.16/java-clients.html) I was trying to use Transport Client. ES cluster is already configured to use SSL and Basic Auth and it works properly.  
I would like to give an answer to my doubt, following step #4, if I specify only

```auto
import org.elasticsearch.xpack.client.PreBuiltXPackTransportClient;
...

TransportClient client = new PreBuiltXPackTransportClient(Settings.builder()
        .put("cluster.name", "myClusterName")
        .put("xpack.security.user", "transport_client_user:x-pack-test-password")
        .put("xpack.security.transport.ssl.enabled", true)
        .put("xpack.security.transport.ssl.certificate_authorities", "/path/to/ca.crt")
        .put("xpack.security.transport.ssl.verification_mode","certificate");
        ...
        .build());

```

so, what will happen if my client will provide only `certificate_authorities` key?

---

<div class="post-metadata">

**Author:** ![Justin\_Cranford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_cranford/32/85302_2.png) [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)\
**Post date:** [February 16, 2022, 9:40pm UTC](https://discuss.elastic.co/t/configuring-the-transport-client-to-work-with-a-secured-cluster/296476/2 "2022-02-16T21:40:31Z")

</div>

You client has 3 settings with prefix `xpack.security.transport.ssl.`. That is sufficient for TLS server authentication only. If you want TLS client authentication, your client is missing 2 more settings. TLS mutual authentication (mTLS) happens when you enable authentication both ways.

Transport mTLS settings:

- `enabled`: enable or disable TLS
- `certificate_authorities` & `verification_mode`: client settings for TLS server authentication
- `key` & `certificate`: client settings for TLS client authentication

The `certificate` setting is the client cert to sent to the server, so the server can check if it came from a trusted CA. The `key` setting is for the client to prove it has the private key which matches the cert public key. For example, the server can send a signature challenge to the client; the client signs with the private key, and the server verifies with the cert public key.

For a complete config example of transport mTLS, it might be helpful to look at the Docker Compose example in Elasticsearch 8.0 documentation. It shows 3 nodes with these 5 settings, so they can talk over mTLS to each other.

> ```
> - xpack.security.transport.ssl.enabled=true
> - xpack.security.transport.ssl.key=certs/es02/es02.key
> - xpack.security.transport.ssl.certificate=certs/es02/es02.crt
> - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
> - xpack.security.transport.ssl.verification_mode=certificate
> 
> ```

If it helps, here is a link to the Docker Compose example in Elasticsearch 8.0 documentation:

- [Running the Elastic Stack ("ELK") on Docker | Getting Started [8.2] | Elastic](https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-stack-docker.html#get-started-docker-tls)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2022, 9:40pm UTC](https://discuss.elastic.co/t/configuring-the-transport-client-to-work-with-a-secured-cluster/296476/3 "2022-03-16T21:40:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.