# Difference between Elasticsearch Security and Watcher Setting in Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** docker\ **Created:** [August 20, 2023, 6:50am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173 "2023-08-20T06:50:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 20, 2023, 6:50am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/1 "2023-08-20T06:50:01Z")
Hi there, I am looking to set security on http and transport layer. But I am confused in what to use between the following: `xpack.security.transport.ssl.verification_mode=certificate` `xpack.transport.ssl.verification_mode=certificate` and `xpack.security.http.ssl.verification_mode=certificate` `xpack.http.ssl.verification_mode=certificate` How these two are different? And when am setting `xpack.http.ssl.verification_mode=certificate` or `xpack.security.http.ssl.verification_mode=certificate` then also I am getting error regarding alt name in SSL certificate like this:- > curl: (60) SSL: no alternative certificate subject name matches target host name '[ec2-52-53-241-135.us-west-1.compute.amazonaws.com](http://ec2-52-53-241-135.us-west-1.compute.amazonaws.com)' ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 20, 2023, 6:00pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/2 "2023-08-20T18:00:39Z")
Hi @ANUBHAV_GUPTA What version of the Elastic Stack are you using? ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 20, 2023, 6:30pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/3 "2023-08-20T18:30:18Z")
hey @stephenb , I am using 8.7.0. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 20, 2023, 7:19pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/4 "2023-08-20T19:19:22Z")
How did you install? this all should have been taken care of if you just did a normal install. > **[Start the Elastic Stack with security enabled automatically | Elasticsearch...](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/configuring-stack-security.html)** These pages show the correct settings. If you are doing all the security manually Transport Level (interface) Security > **[Set up basic security for the Elastic Stack | Elasticsearch Guide \[8.7\] |...](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/security-basic-setup.html)** HTTP Interface Security > **[Set up basic security for the Elastic Stack plus secured HTTPS traffic |...](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/security-basic-setup-https.html)** None of this has a direct relationship to watcher other than you need security enabled to use watcher. Here is the list of TLS setting > **[Security settings in Elasticsearch | Elasticsearch Guide \[8.7\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/security-settings.html#ssl-tls-settings)** the `xpack.security.*` setting are the correct form, not sure where you got the others from ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 3:48am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/5 "2023-08-21T03:48:00Z")
I am using the docker installation. What does the watcher setting mean in Elasticsearch? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 21, 2023, 3:52am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/6 "2023-08-21T03:52:12Z")
Nothing unless you are specifically trying to use watcher. Are you using watcher? You will need to provide much more information if you are. ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 3:56am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/7 "2023-08-21T03:56:54Z")
I am actually trying to use my own set of certificate to set up security. But while setting `xpack.security.http.ssl.verification_mode=certificate` am still getting the hostname verification. ```auto curl: (60) SSL: no alternative certificate subject name matches target host name 'ec2-52-53-241-135.us-west-1.compute.amazonaws.com' ``` According to the `verification_mode set to certificate`, Should'nt it skip the hostname check? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 21, 2023, 4:11am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/8 "2023-08-21T04:11:47Z")
Proper syntax is `xpack.security.http.ssl.verification_mode: certificate` Not `=` So it is probably being ignored ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 4:24am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/9 "2023-08-21T04:24:21Z")
I am passing this as an env variable in docker run command. So, I believe the syntax is fine here, Isn't it? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 21, 2023, 4:34am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/10 "2023-08-21T04:34:02Z")
Perhaps..just guessing because you haven't really clearly shared what you are doing... Just parts... The settings work when properly configured. Try `none` first then proceed from there. ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 4:48am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/11 "2023-08-21T04:48:06Z")
Sure, here is the command I am using:- > sudo docker run -it --privileged -p 9200:9200 -p 9300:9300 -e discovery.type=multi-node -e "cluster.name=my-elasticsearch-cluster" -e node.name="node-1" -e discovery.seed\_hosts=["10.0.0.211","10.0.0.228","192.168.0.136"] -e network.host="0.0.0.0" -e node.roles="master" -e cluster.initial\_master\_nodes=["node-1","node-2","node-3"] -e network.publish\_host="10.0.0.228" -e ELASTIC\_PASSWORD=elastic -e xpack.ml.enabled=false -e ES\_JAVA\_OPTS="-Xms1g -Xmx1g" -v /home/anubhav/certs:/usr/share/elasticsearch/config/certificates -e xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/certificates/key.pem -e xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/certificates/cert.pem -e xpack.security.transport.ssl.enabled=true -e xpack.security.transport.ssl.verification\_mode=certificate -e xpack.security.transport.ssl.certificate\_authorities=/usr/share/elasticsearch/config/certificates/cacert.pem -e xpack.security.http.ssl.enabled=true -e xpack.security.http.ssl.verification\_mode=certificate -e xpack.security.http.ssl.certificate\_authorities=/usr/share/elasticsearch/config/certificates/cacert.pem -e xpack.security.http.ssl.key=/usr/share/elasticsearch/config/certificates/key.pem -e xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/certificates/cert.pem elasticsearch:8.7.0 ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 21, 2023, 5:18am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/12 "2023-08-21T05:18:21Z")
Ok...so a little more > xpack.security.http.ssl.verification\_mode > (Static) The SSL settings in xpack.security.http.ssl control a server context for TLS, which defines the settings for the TLS connection. The use of verification\_mode in a TLS server is discouraged. Defines how to verify the certificates presented by another party in the TLS connection: The key being... > Defines how to verify the certificates presented by another party in the TLS connection: Sorry I was not clear what you were doing... You should not mess with that setting. What you are doing is using `curl` a client When you connect with curl ... It is curl that is verifying the cert not elasticsearch... That is the error you are seeing For `curl`... You need to provide the CA or use the -k option Try `curl -v -k -u elastic https://theelastichost:9200` And / or you can try the `--cacert` option and provide a path to the CA ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 6:43am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/13 "2023-08-21T06:43:51Z")
Actually i am trying the same thing from beginning, which you suggested, here is the curl request:- > REQUEST:- > curl --cacert ./ca.pem [https://elastic:elastic@ec2-52-53-241-135.us-west-1.compute.amazonaws.com:9200](https://elastic:elastic@ec2-52-53-241-135.us-west-1.compute.amazonaws.com:9200) > RESPONSE:- > curl: (60) SSL: no alternative certificate subject name matches target host name '[ec2-52-53-241-135.us-west-1.compute.amazonaws.com](http://ec2-52-53-241-135.us-west-1.compute.amazonaws.com)' > More details here: [curl - SSL CA Certificates](https://curl.haxx.se/docs/sslcerts.html) > curl failed to verify the legitimacy of the server and therefore could not > establish a secure connection to it. To learn more about this situation and > how to fix it, please visit the web page mentioned above. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 21, 2023, 6:48am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/14 "2023-08-21T06:48:48Z")
So you have a self signed cert that is appears not to be correct. If you had run curl like I suggested with the -v option it would have given you a lot more details. Either your cert is not correct and / or you are not presenting the correct CA or both. Run with `-v` you will get more detail, then you should be able to discount... This is normal cert stuff ---
**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Post date:** [August 21, 2023, 7:11am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/15 "2023-08-21T07:11:36Z")
see the cert file use hostname or domainname change xpack.security.http.ssl.verification\_mode: none you can use ssl not validate cert ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 7:56am UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/16 "2023-08-21T07:56:20Z")
setting verification\_mode=none will hamper the security more. I am looking for some way, if the hostname verification can be turned off. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 21, 2023, 2:09pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/17 "2023-08-21T14:09:23Z")
> [@ANUBHAV\_GUPTA](#): > > verification\_mode=none Hi @ANUBHAV_GUPTA I do not think that will fix the issue anyway. I think Perhaps you are confused where the error is coming from and what that setting is used for. The error is coming from curl not elasticsearch. The setting you are using validates the certificate that is presented to elasticsearch from the client for mutual verification... curl is not requesting mutual validation. Therefore that setting has no effect. curl is validating the elasticsearch cert on its side... Not the server / elasticsearch side Please run the following and show both the commands and full output `curl -v -k ....` `curl -v --cacert...` Please show the full command and full output. ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 3:43pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/18 "2023-08-21T15:43:45Z")
Hey @stephenb , Here is the output for the commands you asked for:- ```auto curl -v --cacert /home/anubhav/Downloads/ca.pem https://elastic:elastic@ec2-13-57-211-186.us-west-1.compute.amazonaws.com:9200 ``` > - Trying 13.57.211.186:9200... > > - TCP\_NODELAY set > > - Connected to [ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com) (13.57.211.186) port \>9200 (#0) > > - ALPN, offering h2 > > - ALPN, offering http/1.1 > > - successfully set certificate verify locations: > > - CAfile: /home/anubhav/Downloads/ca.pem > CApath: /etc/ssl/certs > > - TLSv1.3 (OUT), TLS handshake, Client hello (1): > > - TLSv1.3 (IN), TLS handshake, Server hello (2): > > - TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): > > - TLSv1.3 (IN), TLS handshake, Certificate (11): > > - TLSv1.3 (IN), TLS handshake, CERT verify (15): > > - TLSv1.3 (IN), TLS handshake, Finished (20): > > - TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): > > - TLSv1.3 (OUT), TLS handshake, Finished (20): > > - SSL connection using TLSv1.3 / TLS\_AES\_256\_GCM\_SHA384 > > - ALPN, server did not agree to a protocol > > - Server certificate: > > - subject: [CN=ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://CN=ec2-13-57-211-186.us-west-1.compute.amazonaws.com) > > - start date: Aug 21 15:32:22 2023 GMT > > - expire date: Nov 19 15:32:22 2023 GMT > > - subjectAltName: host "[ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com)" matched cert's "[ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com)" > > - issuer: 1.3.6.1.4.1.49690.1.3.1=9a7dd16d-149e-45a9-a593-185361eff3b6; 1.3.6.1.4.1.49690.1.3.2=6d8bcb2b-327d-4de3-8479-825b38da3dcc; CN=Default Enclave Zone Root > > - SSL certificate verify ok. > > - Server auth using Basic with user 'elastic' > GET / HTTP/1.1 > Host: [ec2-13-57-211-186.us-west-1.compute.amazonaws.com:9200](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com:9200) > Authorization: Basic ZWxhc3RpYzplbGFzdGlj > User-Agent: curl/7.68.0 > Accept: _/_ > > - TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): > > - Mark bundle as not supporting multiuse > \< HTTP/1.1 200 OK > \< X-elastic-product: Elasticsearch > \< content-type: application/json > \< content-length: 525 > \< > { > "name" : "node-1", > "cluster\_name" : "my-elasticsearch-cluster", > "cluster\_uuid" : "_na_", > "version" : { > "number" : "8.7.0", > "build\_flavor" : "default", > "build\_type" : "docker", > "build\_hash" : "09520b59b6bc1057340b55750186466ea715e30e", > "build\_date" : "2023-03-27T16:31:09.816451435Z", > "build\_snapshot" : false, > "lucene\_version" : "9.5.0", > "minimum\_wire\_compatibility\_version" : "7.17.0", > "minimum\_index\_compatibility\_version" : "7.0.0" > }, > "tagline" : "You Know, for Search" > } > > - Connection #0 to host [ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com) left intact ```auto curl -v -k https://elastic:elastic@ec2-13-57-211-186.us-west-1.compute.amazonaws.com:9200 ``` > - Trying 13.57.211.186:9200... > > - TCP\_NODELAY set > > - Connected to [ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com) (13.57.211.186) port 9200 (#0) > > - ALPN, offering h2 > > - ALPN, offering http/1.1 > > - successfully set certificate verify locations: > > - CAfile: /etc/ssl/certs/ca-certificates.crt > CApath: /etc/ssl/certs > > - TLSv1.3 (OUT), TLS handshake, Client hello (1): > > - TLSv1.3 (IN), TLS handshake, Server hello (2): > > - TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): > > - TLSv1.3 (IN), TLS handshake, Certificate (11): > > - TLSv1.3 (IN), TLS handshake, CERT verify (15): > > - TLSv1.3 (IN), TLS handshake, Finished (20): > > - TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): > > - TLSv1.3 (OUT), TLS handshake, Finished (20): > > - SSL connection using TLSv1.3 / TLS\_AES\_256\_GCM\_SHA384 > > - ALPN, server did not agree to a protocol > > - Server certificate: > > - subject: [CN=ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://CN=ec2-13-57-211-186.us-west-1.compute.amazonaws.com) > > - start date: Aug 21 15:32:22 2023 GMT > > - expire date: Nov 19 15:32:22 2023 GMT > > - issuer: 1.3.6.1.4.1.49690.1.3.1=9a7dd16d-149e-45a9-a593-185361eff3b6; 1.3.6.1.4.1.49690.1.3.2=6d8bcb2b-327d-4de3-8479-825b38da3dcc; CN=Default Enclave Zone Root > > - SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway. > > - Server auth using Basic with user 'elastic' > GET / HTTP/1.1 > Host: [ec2-13-57-211-186.us-west-1.compute.amazonaws.com:9200](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com:9200) > Authorization: Basic ZWxhc3RpYzplbGFzdGlj > User-Agent: curl/7.68.0 > Accept: _/_ > > - TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): > > - Mark bundle as not supporting multiuse > \< HTTP/1.1 200 OK > \< X-elastic-product: Elasticsearch > \< content-type: application/json > \< content-length: 525 > \< > { > "name" : "node-1", > "cluster\_name" : "my-elasticsearch-cluster", > "cluster\_uuid" : "_na_", > "version" : { > "number" : "8.7.0", > "build\_flavor" : "default", > "build\_type" : "docker", > "build\_hash" : "09520b59b6bc1057340b55750186466ea715e30e", > "build\_date" : "2023-03-27T16:31:09.816451435Z", > "build\_snapshot" : false, > "lucene\_version" : "9.5.0", > "minimum\_wire\_compatibility\_version" : "7.17.0", > "minimum\_index\_compatibility\_version" : "7.0.0" > }, > "tagline" : "You Know, for Search" > } > > - Connection #0 to host [ec2-13-57-211-186.us-west-1.compute.amazonaws.com](http://ec2-13-57-211-186.us-west-1.compute.amazonaws.com) left intact ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 21, 2023, 3:58pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/19 "2023-08-21T15:58:49Z")
@ANUBHAV_GUPTA Cool Thanks! So we can see the first command: `curl -v --cacert /home/anubhav/Downloads/ca.pem https://elastic:elastic@ec2-13-57-211-186.us-west-1.compute.amazonaws.com:9200` connects successfully and is fully valid when you use the CA Cert. because your elasticsearch cert appears to be a Self-Signed cert ... not a publicly signed cert that is why you need to provide the CA to the client so the client (`curl`) can do client-side validation So `curl` and `elasticsearch` are operating properly exactly as expected... So you will need to provide the CA cert for other client connections such as filebeat, logstash etc. You can / should take out the `xpack.security.http.ssl.verification_mode=certificate` unless you are very clear on the form of Mutual Validation you want to accomplish if / when you ever use that... you would need to specify on the client side you want to do mutual TLS if you are not familiar with that perhaps you could read up on it. ---
**Author:** ![ANUBHAV\_GUPTA](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Post date:** [August 21, 2023, 4:35pm UTC](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173/20 "2023-08-21T16:35:42Z")
thanks @stephenb, I would also like to know, How can i connect kibana to this? What pair of certs do I need to provide in Kibana docker run command? [Next page](https://discuss.elastic.co/t/difference-between-elasticsearch-security-and-watcher-setting-in-elasticsearch/341173.md?page=2)