# Enabling ssl on intra-node communication in cluster?

**URL:** <https://discuss.elastic.co/t/enabling-ssl-on-intra-node-communication-in-cluster/1860>\
**Category:** Elasticsearch\
**Created:** [June 3, 2015, 6:41pm UTC](https://discuss.elastic.co/t/enabling-ssl-on-intra-node-communication-in-cluster/1860 "2015-06-03T18:41:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vhj](https://avatars.discourse-cdn.com/v4/letter/v/f14d63/32.png) [@vhj](https://discuss.elastic.co/u/vhj)\
**Post date:** [June 3, 2015, 6:41pm UTC](https://discuss.elastic.co/t/enabling-ssl-on-intra-node-communication-in-cluster/1860/1 "2015-06-03T18:41:10Z")

</div>

A google search for enabling ssl on elasticsearch returns nothing but hits about enabling this for the the http communication.

What about the communication between the nodes in a cluster? The ones described here:

> **[Elasticsearch Internals: Networking Introduction
	  	 | Elastic](https://www.elastic.co/blog/found-elasticsearch-networking)**
>
> This article introduces the networking part of Elasticsearch. We look at the network topology of an Elasticsearch cluster, which connections are established between which nodes and how the different Java clients works. Finally, we look a bit closer...

By default, anyone sniffing the packets between cluster nodes can see all the documents being sent between the nodes in plain text. How can this be secured?

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [June 3, 2015, 6:57pm UTC](https://discuss.elastic.co/t/enabling-ssl-on-intra-node-communication-in-cluster/1860/2 "2015-06-03T18:57:31Z")

</div>

Have a look at  
[https://www.elastic.co/guide/en/shield/current/separating-node-client-traffic.html](https://www.elastic.co/guide/en/shield/current/separating-node-client-traffic.html)

I'm not sure how much of that works without Shield.

Nik

---

<div class="post-metadata">

**Author:** ![vhj](https://avatars.discourse-cdn.com/v4/letter/v/f14d63/32.png) [@vhj](https://discuss.elastic.co/u/vhj)\
**Post date:** [June 4, 2015, 8:51pm UTC](https://discuss.elastic.co/t/enabling-ssl-on-intra-node-communication-in-cluster/1860/3 "2015-06-04T20:51:44Z")

</div>

thanks nik, looks like Shield is the only way to go.

---

<div class="post-metadata">

**Author:** ![rectalogic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rectalogic/32/44827_2.png) [@rectalogic](https://discuss.elastic.co/u/rectalogic)\
**Post date:** [June 5, 2015, 7:23pm UTC](https://discuss.elastic.co/t/enabling-ssl-on-intra-node-communication-in-cluster/1860/4 "2015-06-05T19:23:13Z")

</div>

We used ipsec transport layer encryption to do this without Shield.

[https://blog.rectalogic.com/2015/03/ipsec-private-subnet.html](https://blog.rectalogic.com/2015/03/ipsec-private-subnet.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:09am UTC](https://discuss.elastic.co/t/enabling-ssl-on-intra-node-communication-in-cluster/1860/5 "2017-07-06T00:09:20Z")

</div>