# ES 7.4 - Xpack

**URL:** <https://discuss.elastic.co/t/es-7-4-xpack/202241>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 3, 2019, 8:31pm UTC](https://discuss.elastic.co/t/es-7-4-xpack/202241 "2019-10-03T20:31:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [October 3, 2019, 8:31pm UTC](https://discuss.elastic.co/t/es-7-4-xpack/202241/1 "2019-10-03T20:31:51Z")

</div>

Hello folks,

I have 3 nodes in my cluster. I can start and reach them without issue when I have **not** enabled xpack. When I enable security to do `elasticsearch-setup-passwords auto`, I have an error when it tries to reach my cluster.

**Config added**  
`xpack.security.enabled: true`  
`xpack.security.transport.ssl.enabled: true`

I ran `/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto --verbose`, it cannot go further than`Checking cluster health: http://<ClusterIP>:9200/_cluster/health?pretty`.

**Error**

> Unexpected response code [503] from calling PUT http://:9200/\_security/user/apm\_system/\_password?pretty  
> Cause: Cluster state has not been recovered yet, cannot write to the [null] index
> 
> Possible next steps:
> 
> - Try running this tool again.
> - Try running with the --verbose parameter for additional messages.
> - Check the elasticsearch logs for additional error details.
> - Use the change password API manually.

According to FSE course, you have to add `xpack.security.enabled: true` only. However it doesn't work and it asks for `xpack.security.transport.ssl.enabled: true`. I have tried to set it to false, no success.

Any insight ?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 4, 2019, 5:47am UTC](https://discuss.elastic.co/t/es-7-4-xpack/202241/2 "2019-10-04T05:47:46Z")

</div>

> [@NewmazN24](#):
>
> xpack.security.transport.ssl.enabled: true

That configuration is insufficient for configuring transport SSL.  
It lacks any key or trust material (certificates) so your 3 nodes cannot connect to each other over SSL.  
We have a guide for setting up SSL here:

- [Setting up TLS on a cluster | Elasticsearch Guide [7.4] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/7.4/ssl-tls.html)

You will need to generate certificates for each of your nodes, and configure them to trust one another.

---

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [October 4, 2019, 1:24pm UTC](https://discuss.elastic.co/t/es-7-4-xpack/202241/3 "2019-10-04T13:24:11Z")

</div>

Thanks a lot Tim. So as I understand the configuration for SSL with Basic license, those settings are also required since server aren't able to reach each other.

```
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certificates.p12
xpack.security.transport.ssl.truststore.path: certificates.p12
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2019, 1:24pm UTC](https://discuss.elastic.co/t/es-7-4-xpack/202241/4 "2019-11-01T13:24:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.