# Connect autoconfigured clusters for cross-cluster-replication

**URL:** <https://discuss.elastic.co/t/connect-autoconfigured-clusters-for-cross-cluster-replication/312005>\
**Category:** Elasticsearch\
**Tags:** ccr-cross-cluster-replication\
**Created:** [August 12, 2022, 10:40am UTC](https://discuss.elastic.co/t/connect-autoconfigured-clusters-for-cross-cluster-replication/312005 "2022-08-12T10:40:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![neox2811](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neox2811/32/103284_2.png) [@neox2811](https://discuss.elastic.co/u/neox2811)\
**Post date:** [August 12, 2022, 10:40am UTC](https://discuss.elastic.co/t/connect-autoconfigured-clusters-for-cross-cluster-replication/312005/1 "2022-08-12T10:40:00Z")

</div>

Hi,

I've got a running production cluster "A" autoconfigured with security on install. The cluster already contains some data / indices.

Now I want to add cross-cluster-replication (Simple Leader -\> Follower setup like [Cross-cluster replication | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-ccr.html#ccr-single-datacenter-recovery)). I've set up a second cluster "B" in a different data center. The documentation states, that I have to add the certificates from remote clusters as trusted CA on the local cluster and veci versa ([Configure remote clusters with security | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-security.html)).

Which certificates do I have to copy and how do I import them in the remote cluster? The autoconfigation on install created three certificates automatically on each of the nodes in each cluster: http\_ca.crt, http.p12, transport.p12 ([Start the Elastic Stack with security enabled automatically | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-stack-security.html#stack-security-certificates))

Any ideas? Thanks.

---

<div class="post-metadata">

**Author:** ![neox2811](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neox2811/32/103284_2.png) [@neox2811](https://discuss.elastic.co/u/neox2811)\
**Post date:** [August 16, 2022, 7:42am UTC](https://discuss.elastic.co/t/connect-autoconfigured-clusters-for-cross-cluster-replication/312005/2 "2022-08-16T07:42:46Z")

</div>

Hi, I worked it out:

1. Copy certs/transport.p12 file from cluster A to all nodes of cluster B (you may have to copy the file to a directory you can write e.g. with scp from a remote server to your home directory. Then copy the file on the cluster B nodes with sudo to /etc/elasticsearch/certs/)
2. Make sure the elasticsearch Unix user owns the file: chown -R root:elasticsearch transport.p12
3. Update the keystore on cluster B  
Find out passwords on any node of cluster A:

```auto
/usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.transport.ssl.keystore.secure_password
/usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.transport.ssl.truststore.secure_password

```

on all nodes of cluster B set the password from cluster A:

```auto
/usr/share/elasticsearch/bin/elasticsearch-keystore remove xpack.security.transport.ssl.keystore.secure_password
/usr/share/elasticsearch/bin/elasticsearch-keystore remove xpack.security.transport.ssl.truststore.secure_password

```

```auto
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

```

1. Restart alle nodes of cluster B. Remote Cluster connection should be working now.

As I stated above, I used autoconfiguration for both of my clusters. Heres my elasticsearch.yml for the transport layer:

```auto
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2022, 7:42am UTC](https://discuss.elastic.co/t/connect-autoconfigured-clusters-for-cross-cluster-replication/312005/3 "2022-09-13T07:42:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.