# Elasticsearch security options - separate certs for node & client traffic
**URL:** https://discuss.elastic.co/t/elasticsearch-security-options-separate-certs-for-node-client-traffic/200683
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [September 23, 2019, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-security-options-separate-certs-for-node-client-traffic/200683 "2019-09-23T11:25:47Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@robertgates55](https://discuss.elastic.co/u/robertgates55)
#### Post date: [September 23, 2019, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-security-options-separate-certs-for-node-client-traffic/200683/1 "2019-09-23T11:25:47Z")
Hi,
I'm looking to set up a cluster where the ES nodes communicate with each other over TLS using self-signed node certs to authenticate; but the ES endpoint (:9200) is http (as we'll then be terminating TLS ourselves with a reverse proxy)
I'd then like, eg kibana, logstash etc, to authenticate with basic auth (via the rev proxy & thus encrypted), but not require a self-signed node cert.
Is this configuration possible with xpack security in 7.3?
Is/was this related: [https://www.elastic.co/guide/en/elasticsearch/reference/7.3/separating-node-client-traffic.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/separating-node-client-traffic.html) ?
(use case is that I want to have a central ES cluster in an environment where cert distribution will be challenging)
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [September 24, 2019, 8:20am UTC](https://discuss.elastic.co/t/elasticsearch-security-options-separate-certs-for-node-client-traffic/200683/2 "2019-09-24T08:20:10Z")
> [@robertgates55](#):
>
> I'm looking to set up a cluster where the ES nodes communicate with each other over TLS using self-signed node certs to authenticate; but the ES endpoint (:9200) is http (as we'll then be terminating TLS ourselves with a reverse proxy)
Yes this is possible, transport and http related SSL configuration is separate , see [Configure TLS | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html)
> [@robertgates55](#):
>
> I'd then like, eg kibana, logstash etc, to authenticate with basic auth (via the rev proxy & thus encrypted), but not require a self-signed node cert.
Yes this is also possible. Just don't configure SSL for the HTTP layer in Elasticsearch.
> [@robertgates55](#):
>
> Is/was this related: [Separating node-to-node and client traffic | Elasticsearch Guide [7.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/separating-node-client-traffic.html) ?
Nope, this was about having different configuration for TLS on the transport layer depending on whether it's node to node communication or client to node ( but still on the transport layer ) communication.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2019, 8:20am UTC](https://discuss.elastic.co/t/elasticsearch-security-options-separate-certs-for-node-client-traffic/200683/3 "2019-10-22T08:20:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.