# Curator over SSL
**URL:** https://discuss.elastic.co/t/curator-over-ssl/52303
**Category:** Elasticsearch
**Created:** [June 9, 2016, 9:12am UTC](https://discuss.elastic.co/t/curator-over-ssl/52303 "2016-06-09T09:12:33Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ympark](https://discuss.elastic.co/u/ympark)
#### Post date: [June 9, 2016, 9:12am UTC](https://discuss.elastic.co/t/curator-over-ssl/52303/1 "2016-06-09T09:12:33Z")
Hi,
Thank you for providing such good applications!
I am using Elasticsearch.curator to manage indices. Recently I started working with a Security plugin (Search Guard, Not Shield).
Basically my problem is curator with SSL.
If I specify '--ssl-no-validate', it works but it generates warning message, which looks from urllib..
This is the command I executed:
`curator --use_ssl --host my_host.com --http_auth xxx:yyy --ssl-no-validate show indices --all-indices`
This is the warning message:
> ..../lib/python2.7/site-packages/urllib3-1.15-py2.7.egg/urllib3/connectionpool.py:821: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: [Advanced Usage - urllib3 2.1.0 documentation](https://urllib3.readthedocs.org/en/latest/security.html)
I am not a Python expert so do not how to suppress these messages..
So if I try with '--certificate', I have got connection errors.
`curator --use_ssl --host my_host.com --http_auth xxx:yyy --certificate /path/to/truststore.pem --debug show indices --all-indices`
This is the last part of errors:
> 2016-06-09 09:35:22,972 DEBUG elasticsearch log\_request\_fail:90 \> None
> 2016-06-09 09:35:22,973 DEBUG urllib3.util.retry from\_int:164 Converted retries value: False -\> Retry(total=False, connect=None, read=None, redirect=0)
> 2016-06-09 09:35:22,973 INFO urllib3.connectionpool \_new\_conn:788 Starting new HTTPS connection (4): [ves-ebi-29.ebi.ac.uk](http://ves-ebi-29.ebi.ac.uk)
> 2016-06-09 09:35:23,003 WARNING elasticsearch log\_request\_fail:82 GET http://my\_host.com:9200/ [status:N/A request:0.030s]
> Traceback (most recent call last):
> File "build/bdist.linux-x86\_64/egg/elasticsearch/connection/http\_urllib3.py", line 94, in perform\_request
> response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, \*\*kw)
> File "build/bdist.linux-x86\_64/egg/urllib3/connectionpool.py", line 578, in urlopen
> chunked=chunked)
> File "build/bdist.linux-x86\_64/egg/urllib3/connectionpool.py", line 351, in \_make\_request
> self.\_validate\_conn(conn)
> File "build/bdist.linux-x86\_64/egg/urllib3/connectionpool.py", line 814, in \_validate\_conn
> conn.connect()
> File "build/bdist.linux-x86\_64/egg/urllib3/connection.py", line 296, in connect
> cert = self.sock.getpeercert()
> File "/.../python2.7.11/lib/python2.7/ssl.py", line 649, in getpeercert
> return self.\_sslobj.peer\_certificate(binary\_form)
> SystemError: error return without exception set
> 2016-06-09 09:35:23,003 DEBUG elasticsearch log\_request\_fail:90 \> None
> 2016-06-09 09:35:23,003 ERROR curator.cli.utils get\_client:140 Connection failure.
Can someone please give some advice that I can try?
Thanks in advance!
Youngmi.
---
### Author:  [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [June 10, 2016, 4:00pm UTC](https://discuss.elastic.co/t/curator-over-ssl/52303/2 "2016-06-10T16:00:22Z")
I know nothing about Search Guard, so I can't be of much specific help. It seems to me that the certificate you provided is not the appropriate, valid CA certificate, which is what [`--certificate`](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/certificate.html) is supposed to point to. Regardless, you can't suppress the urllib3 message when using `--ssl-no-validate`. It is a warning that you are not verifying the security chain. It doesn't mean that the transaction is not going over SSL, just that security cannot be guaranteed because the certificate chain is unverified.
Depending on how Search Guard works, you might be able to use [`--client-cert`](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/client-cert.html) and [`--client-key`](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/client-key.html) (generated and signed by the same CA that you used for the security solution you're using).
---
### Author:  [@ympark](https://discuss.elastic.co/u/ympark)
#### Post date: [June 13, 2016, 7:32am UTC](https://discuss.elastic.co/t/curator-over-ssl/52303/3 "2016-06-13T07:32:33Z")
Thank you for the reply! I will try the two parameters instead!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:44pm UTC](https://discuss.elastic.co/t/curator-over-ssl/52303/4 "2017-07-05T22:44:25Z")