# Enabling TTL & RBAC on an existing cluster with Indexes **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [January 17, 2020, 5:37am UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414 "2020-01-17T05:37:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![gsahu25](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@gsahu25](https://discuss.elastic.co/u/gsahu25)\ **Post date:** [January 17, 2020, 5:37am UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/1 "2020-01-17T05:37:53Z")
Hi, Below is the scenario. I have a multi-node Elasticsearch cluster with indices. I want to enable the TTL,RBAC security on it. If I follow the steps given in the documentation, would that work? As there are indices already on it, I want to know if any precaution I need to take while working through the steps to enable TTL, RBAC. Regards, Gopal ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [January 17, 2020, 5:58am UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/2 "2020-01-17T05:58:15Z")
> [@gsahu25](#): > > If I follow the steps given in the documentation, would that work? Yes 🙂 > [@gsahu25](#): > > As there are indices already on it, I want to know if any precaution Just keep in mind that now, all your users have access to all the indices. When you enable security, the users that will be authenticating will not _by default_ have access to any indices as you will need to create and assign them roles that give them the required access to indices ( This is what RBAC is ). ---
**Author:** ![gsahu25](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@gsahu25](https://discuss.elastic.co/u/gsahu25)\ **Post date:** [January 20, 2020, 11:22am UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/3 "2020-01-20T11:22:23Z")
Thanks @ikakavas. After setting up the TLS & RBAC, I am trying with below curl command. But is it giving me error. _curl -X GET --cacert -/etc/elasticsearch/cert/HOST\_IP.p12 --user user:pass "https://HOST\_IP:9200/\_cat/indices?v"_ Response: **curl: (77) Problem with the SSL CA cert (path? access rights?)** I even tried with elastic-ca-cert.p12 file, but same error. I have given full permission to the .p12 files. I could get response using -k option but I want to use --cacert option. Regards, Gopal ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [January 20, 2020, 11:35am UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/4 "2020-01-20T11:35:03Z")
This is a `curl` question rather than an Elasticsearch one. `curl` can't read CA certificates from `PKCS#12` stores so you need to export the CA certificate in PEM format. Try ```auto openssl pkcs12 -in elastic-ca-cert.p12 -cacerts -nokeys | sed '/-----BEGIN CERTIFICATE-----/,$!d' > cacert.crt ``` and ```auto curl -X GET --cacert --user user:pass "https://HOST_IP:9200/_cat/indices?v" ``` ---
**Author:** ![gsahu25](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@gsahu25](https://discuss.elastic.co/u/gsahu25)\ **Post date:** [January 20, 2020, 11:53am UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/5 "2020-01-20T11:53:28Z")
@ikakavas: Should I be generating .cert file from elastic-stack-ca.p12 (generated from **elasticsearch-certutil ca** - this would mean same .cert file across cluster) or the node specific .p12 files (.cert file for each node)? Regards, Gopal ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [January 20, 2020, 12:02pm UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/6 "2020-01-20T12:02:14Z")
You _should_ be using the same CA for all your nodes in your cluster, so you _should_ have one `elastic-ca-cert.p12` file, and it _should_ be enough that `curl` trusts this CA certificate. I'm using _should_ as you haven't shared anything with us about your setup, so all we can do is guess 🙂 ---
**Author:** ![gsahu25](https://avatars.discourse-cdn.com/v4/letter/g/53a042/32.png) [@gsahu25](https://discuss.elastic.co/u/gsahu25)\ **Post date:** [January 20, 2020, 12:30pm UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/7 "2020-01-20T12:30:10Z")
@ikakavas: I have followed the default steps given in the documentation: 1. generated CA 2. generated multiple certificates using IP, moved them to other nodes and placed them on /etc/elasticsearch/certs directory. Given permissions. 3. added required configurations for TSL and HTTP in elasticsearch.yml file 4. Generated passwords for built-in users. With **elasticsearch-certutil ca** , it generated elastic-stack-ca.p12 file and with **elasticsearch-certutil cert** , I generated multiple HOST\_IP.p12 files for nodes which i moved in step 2 above. As you have already said there should be **one** elastic-ca-cert.p12, I believe you are referring to the file generated by **elasticsearch-certutil ca**. Correct me if I am wrong here. I tried with elastic-stack-ca.p12 and it works for me. Thanks again. Regards, Gopal ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 17, 2020, 12:30pm UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414/8 "2020-02-17T12:30:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.