# Elastic Map Server with PKI Auth

**URL:** <https://discuss.elastic.co/t/elastic-map-server-with-pki-auth/360873>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, docker\
**Created:** [June 5, 2024, 4:13pm UTC](https://discuss.elastic.co/t/elastic-map-server-with-pki-auth/360873 "2024-06-05T16:13:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![m.hanna](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@m.hanna](https://discuss.elastic.co/u/m.hanna)\
**Post date:** [June 5, 2024, 4:13pm UTC](https://discuss.elastic.co/t/elastic-map-server-with-pki-auth/360873/1 "2024-06-05T16:13:52Z")

</div>

We are running an Elastic Maps Server (EMS) in a docker swarm. I am wondering if it possible to configure EMS to use PKI authentication to Elasticsearch instead of username/password.  
I have configured PKI certificates and they work to authenticate from inside the EMS container (the superuser role is only for testing purposes).

```auto
# docker exec -it 48f99803a01f curl -k https://elasticsearch:9200/_security/_authenticate?pretty --key config/certs/ems/ems.key --cert config/certs/ems/ems.crt --cacert config/certs/ca/ca.crt
{
  "username" : "ems",
  "roles" : [
    "superuser"
  ],
  "full_name" : null,
  "email" : null,
  "metadata" : {
    "pki_dn" : "CN=ems"
  },
  "enabled" : true,
  "authentication_realm" : {
    "name" : "pki1",
    "type" : "pki"
  },
  "lookup_realm" : {
    "name" : "pki1",
    "type" : "pki"
  },
  "authentication_type" : "realm"
}

```

Based on [Connect to Elastic Maps Service | Kibana Guide [8.14] | Elastic](https://www.elastic.co/guide/en/kibana/current/maps-connect-to-ems.html#elastic-maps-server), I tried to set the certificates in the environment variables, like:

```auto
BASEPATH=/map
ELASTICSEARCH_HOST=https://elasticsearch:9200
ELASTICSEARCH_SSL_CERTIFICATE=config/certs/ems/ems.crt
ELASTICSEARCH_SSL_KEY=config/certs/ems/ems.key
ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt

```

But that doesn't allow for connection to Elasticsearch. The log entries:

```auto
 {"log.level":"info","@timestamp":"2024-06-05T15:50:54.571Z","process.pid":1,"host.hostname":"ems","log.logger":"Elastic Maps Server","ecs.version":"8.10.0","created":1717602654458,"started":1717602654562,"host":"ems","port":8080,"protocol":"http","id":"ems:1:lx209u62","uri":"http://ems:8080","address":"10.10.1.26","message":"server started"}
 {"log.level":"error","@timestamp":"2024-06-05T15:50:54.623Z","process.pid":1,"host.hostname":"ems","log.logger":"Elastic Maps Server","ecs.version":"8.10.0","message":"Unable to connect to the Elasticsearch cluster: https://elasticsearch:9200"}

```

Using username/password in the environment work just fine, however:

```auto
BASEPATH=/map
ELASTICSEARCH_HOST=https://elasticsearch:9200
ELASTICSEARCH_USERNAME=<ems_user>
ELASTICSEARCH_PASSWORD=<ems_pass>
ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt

```