# Curl against an encrypted Elasticsearch instance with certificate verification

**URL:** https://discuss.elastic.co/t/curl-against-an-encrypted-elasticsearch-instance-with-certificate-verification/251503
**Category:** Elasticsearch
**Created:** [October 8, 2020, 8:05pm UTC](https://discuss.elastic.co/t/curl-against-an-encrypted-elasticsearch-instance-with-certificate-verification/251503 "2020-10-08T20:05:03Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [October 11, 2020, 11:27am UTC](https://discuss.elastic.co/t/curl-against-an-encrypted-elasticsearch-instance-with-certificate-verification/251503/2 "2020-10-11T11:27:10Z")

</div>

Ok thanks to a colleague of mine I finally found how to make it work for a localhost instance (or cluster as in my case). Here are the steps:

1. Create a file `instance.yml` like the following:

2. Create the certificate with the following command of the `certutil` tool:

`bin/elasticsearch-certutil cert --keep-ca-key ca --pem --in instance.yml --out certs.zip`

It will spit out a zip file with the following structure (once extracted in the `certs` folder):

```
certs
├── ca
│ ├── ca.crt
│ └── ca.key
└── node
    ├── node.crt
    └── node.key

```

1. Create a folder (e.g. `certs`) at the path `$ES_HOME/config` and copy the files `ca.crt`, `node.crt` and `node.key` in that folder.

2. Configure the ssl part in the `elasticsearch.yml` file as following:

3. Start Elasticsearch

4. Set up authentication with

`bin/elasticsearch-setup-passwords interactive`

1. Now you can cURL elasticsearch without ignoring the certificate with

`curl --cacert $ES_HOME/config/certs/ca.crt -XGET "https://localhost:9200" -u elastic`

1. If you want to have a Kibana instance connecting to the ES instance with full verification mode (without skipping the hostname verification) you can create a folder in the `$KIBANA_HOME/config` folder (e.g. `certs`) and copy there the `ca.crt` certificate file. Then, in your `$KIBANA_HOME/config/kibana.yml` file you set:

P.S. note that `full` is the default value for `elasticsearch.ssl.verificationMode`, so no need to specify it.

Hope it helps anybody trying to set a local instance with certificates to carry out tests like me.

---

_[View the full topic](https://discuss.elastic.co/t/curl-against-an-encrypted-elasticsearch-instance-with-certificate-verification/251503)._