# Elasticsearch security warning when i connect to cluster from outside

**URL:** <https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 31, 2021, 9:45pm UTC](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768 "2021-01-31T21:45:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![first100](https://avatars.discourse-cdn.com/v4/letter/f/6a8cbe/32.png) [@first100](https://discuss.elastic.co/u/first100)\
**Post date:** [January 31, 2021, 9:45pm UTC](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768/1 "2021-01-31T21:45:57Z")

</div>

Hello,

i was able to secure my elastic cluster with certificates generated from elasticsearch-certutil command, but i f try to open my node : [https://elk-001:9200](https://elk-001:9200) from outside , receive warning from browser, about the certificates , firefox show me :

```auto
Someone could be trying to impersonate the site and you should not continue.
 
Websites prove their identity via certificates. Firefox does not trust elk-001:9200 because its certificate issuer is unknown, the certificate is self-signed, or the server is not sending the correct intermediate certificates.
 
Error code: SEC_ERROR_UNKNOWN_ISSUER
 
View Certificate

```

this is from edge:

```auto
    This server couldn't prove that it's **elk-001** ; its security certificate is from **elk-elastic- 
    cluster-node-1**. This may be caused by a misconfiguration or an attacker intercepting your 
    connection.

```

I installed on client ca.crt generated from elastic , but it wasn't helpful to solve the issue.  
Can you help me?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 1, 2021, 10:01am UTC](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768/2 "2021-02-01T10:01:06Z")

</div>

The certificate warning you receive is a valid one. Firefox and Edge ( as all browsers ) come with a predefined list of Certificate Authorities they trust to issue certificates for TLS and they only trust certificates signed by those. You have created your own certificates signed by a custom self generated CA with elasticsearch tooling and your browser tells you that it doesn't trust the certificate as it is not issued by one of the CAs it knows and trusts.

Your solutions are:

- Install the CA certificate that was generated by the `elasticsearch-certutil` command as a trusted certfiicate authority in your browser settings. This will ensure that you don't get the warning any more but has 2 caveats. A) You need to make sure that CA key is stored securely and b) you need to install the CA certificate to all browsers/systems used to access that cluster.
- Get yourself a TLS certificate for your domain by a well known and trusted CA and use that instead of the self-generated one.

BTW, Elasticsearch's REST API is not best consumed over a browser, how are you planning on interacting with it in the long run ?

> [@first100](#):
>
> I installed on client ca.crt generated from elastic ,

What did you do, exactly?

---

<div class="post-metadata">

**Author:** ![first100](https://avatars.discourse-cdn.com/v4/letter/f/6a8cbe/32.png) [@first100](https://discuss.elastic.co/u/first100)\
**Post date:** [February 1, 2021, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768/3 "2021-02-01T10:32:50Z")

</div>

Thanks for reply,

> [@ikakavas](#):
>
> BTW, Elasticsearch's REST API is not best consumed over a browser, how are you planning on interacting with it in the long run ?

I accessed from browser only to check if the cluster were in healthy status,  
but it's probably something the QA wants.

> [@ikakavas](#):
>
> What did you do, exactly?

On my machine, (im using windows 10), i have imported the CA, generated from elastic command elasticsearch-certutil, ca.crt under trusted root certification authority, and also, under intermediate certification authority.  
But the warning is still there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2021, 10:33am UTC](https://discuss.elastic.co/t/elasticsearch-security-warning-when-i-connect-to-cluster-from-outside/262768/4 "2021-03-01T10:33:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.