# Elasticsearch HTTPS and Adding to Java Rest Client

**URL:** <https://discuss.elastic.co/t/elasticsearch-https-and-adding-to-java-rest-client/365477>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 23, 2024, 9:14pm UTC](https://discuss.elastic.co/t/elasticsearch-https-and-adding-to-java-rest-client/365477 "2024-08-23T21:14:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![GoldNotepad](https://avatars.discourse-cdn.com/v4/letter/g/90db22/32.png) [@GoldNotepad](https://discuss.elastic.co/u/GoldNotepad)\
**Post date:** [August 23, 2024, 9:14pm UTC](https://discuss.elastic.co/t/elasticsearch-https-and-adding-to-java-rest-client/365477/1 "2024-08-23T21:14:52Z")

</div>

I'm attempting to enable HTTPS for elasticsearch.

First I create the elasticsearch certificate authority.

```auto
elasticsearch-certutil ca

```

Then I generate the certificate.

```auto
elasticsearch-certutil cert --ca elastic-stack-ca.p12

```

This generates elastic-certificates.p12.

I have the configuration in my /usr/share/elasticsearch/config/elasticsearch.yml

```auto
xpack.security.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.type: PKCS12
xpack.security.http.ssl.keystore.path: elastic-certificate.p12

```

For my RestClient I have:

```auto
RestClientBuilder clientBuilder = RestClient.builder(
  new HttpHost(host, port, "https"))
  .setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder
    .setSSLContext(sslContext)
    .setDefaultCredentialsProvider(credentialsProvider));

```

Adding the following code to allow the truststore doesn't seem to work.

```auto
String trustStoreFileName = "elastic-certificates.p12";
char[] trustStorePassword = null;
SSLContext sslContext;

ClassLoader classLoader = <FileName.java>.class.getClassLoader();
try (InputStream inputStream = classLoader.getResourceAsStream(trustStoreFilename)) {
  if (inputStream == null) {
    throw <ERROR>
  }
  KeyStore trustStore = Keystore.getInstance("PKCS12");
  trustStore.load(inputStream, trustStorePassword);
  sslContext = SSLContextBuilder.create().loadTrustMaterial(trustStore, null).build();
} catch (Exception e) { ... }

```

I'm not super familiar with how SSL works in this case. Does this seem right? Making requests explicitly ignoring the certificate seems to work but that is not what I want.

Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 26, 2024, 12:07pm UTC](https://discuss.elastic.co/t/elasticsearch-https-and-adding-to-java-rest-client/365477/2 "2024-08-26T12:07:58Z")

</div>

Welcome!

May be this could help?

> <https://github.com/testcontainers/testcontainers-java/blob/main/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/ElasticsearchContainer.java#L172>