# ElasticSearch 6.5.1 TLS setting **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 12, 2020, 5:21pm UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796 "2020-10-12T17:21:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![varom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varom/32/47522_2.png) [@varom](https://discuss.elastic.co/u/varom)\ **Post date:** [October 12, 2020, 5:21pm UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/1 "2020-10-12T17:21:43Z")
Hi , i am struggling for long time to establish TLS communication between 2 nodes. I followed : [https://www.elastic.co/guide/en/elasticsearch/reference/6.5/configuring-tls.html#node-certificates](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/configuring-tls.html#node-certificates) Also check several links , nothing is working in my case . **Done:** 1. bin/elasticsearch-certutil ca 2. bin/elasticsearch-certutil cert --ca elastic\_cert\_v1.p12 i've placed the created "elastic\_cert\_v1.p12" to each node under config/certs Restarted both ES nodes. Cluster is working fine without TSL. ```auto [ **Getting error:** [WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [hostname] exception caught on transport layer [NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/127.0.0.1:35222}], closing connection io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 455300000027000000000000a32208004c4ba3000016696e7465726e616c3a7463702f68616e647368616b6500 at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.30.Final.jar:4.1.30.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-common-4.1.30.Final.jar:4.1.30.Final] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_251] Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 455300000027000000000000a32208004c4ba3000016696e7465726e616c3a7463702f68616e647368616b6500 at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1178) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1243) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final] * ... 15 more` ``` \*\*elasticsearch.yml \*\* xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ```auto node.name: hostname path.data: /var/apps/elasticsearch/6.5.1/data cluster.name: elasticsearch-app_prod network.host: 0.0.0.0 script.painless.regex.enabled: true path.logs: /var/log/elasticsearch http.port: 9200 path.repo: ["/var/apps/elasticsearch/6.5.1/snapshots"] node.master: true node.data: true discovery.zen.ping.unicast.hosts: ["ip_node1", "ip_node2"] discovery.zen.minimum_master_nodes: 1 xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: certs/elastic_cert_v1.p12 xpack.security.transport.ssl.truststore.path: certs/elastic_cert_v1.p12 ``` On second node in log there is not above error .Instead the last line is: _Cluster health status changed from [YELLOW] to [GREEN]_ **Any help would be greatly appreciated !** ` ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 13, 2020, 1:35am UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/2 "2020-10-13T01:35:33Z")
> [@varom](#): > > Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: One of your nodes isn't configured to use SSL. Did you set ```auto xpack.security.transport.ssl.enabled: true ``` on _every_ node and then restart them all? ---
**Author:** ![varom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varom/32/47522_2.png) [@varom](https://discuss.elastic.co/u/varom)\ **Post date:** [October 13, 2020, 4:33am UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/3 "2020-10-13T04:33:38Z")
yes, i have same xpack lines on both ES.yml. ---
**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\ **Post date:** [October 13, 2020, 7:04am UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/4 "2020-10-13T07:04:24Z")
Could you share your full `elasticsearch.yml` and format your codes and errors under preformatted text `` or backticks `(```)` as it is really hard to read otherwise. ---
**Author:** ![varom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varom/32/47522_2.png) [@varom](https://discuss.elastic.co/u/varom)\ **Post date:** [October 13, 2020, 7:51am UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/5 "2020-10-13T07:51:50Z")
looks much readable now 🙂 . Config yml content is same on second node. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 13, 2020, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/6 "2020-10-13T10:07:45Z")
As Tim mentioned, there is an ES node in the same host (`remoteAddress=/127.0.0.1` ) as the one where you get the error that is not configured to use TLS for the transport layer and is attempting to connect to your node. ```auto 455300000027000000000000a32208004c4ba3000016696e7465726e616c3a7463702f68616e647368616b6500 ``` is an attempt by that node to start a TCP handshake with your node. ---
**Author:** ![varom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varom/32/47522_2.png) [@varom](https://discuss.elastic.co/u/varom)\ **Post date:** [October 13, 2020, 7:39pm UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/7 "2020-10-13T19:39:50Z")
I have only one ES running according : _ps aux | grep "elastic_"\* (same outcome on both nodes) Questions: 1. How to verify TSL is properly running on each node ? 2. Can the problem with TSL, not to be configured on node1 (where error is recorded), be with "p12" file ? The "elastic\_cert\_v1.p12" was created on one node and then copied to the second one. Could this be an issue? 3. On second node , the log says : cluster is Green ... Does it mean that cluster is working with TSL ? I'm a newbie in ES as such ..could figure out the cluster set up ,but TSL is over me at the moment. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 10, 2020, 7:40pm UTC](https://discuss.elastic.co/t/elasticsearch-6-5-1-tls-setting/251796/8 "2020-11-10T19:40:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.