# ES-Hadoop config for writing to ES cluster behind a protected SSL VIP **URL:** \ **Category:** Elasticsearch\ **Tags:** es-hadoop\ **Created:** [September 14, 2016, 4:04am UTC](https://discuss.elastic.co/t/es-hadoop-config-for-writing-to-es-cluster-behind-a-protected-ssl-vip/60451 "2016-09-14T04:04:10Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![ashokc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashokc/32/11892_2.png) [@ashokc](https://discuss.elastic.co/u/ashokc)\ **Post date:** [September 14, 2016, 4:04am UTC](https://discuss.elastic.co/t/es-hadoop-config-for-writing-to-es-cluster-behind-a-protected-ssl-vip/60451/1 "2016-09-14T04:04:10Z")
There seem to be quite a few ssl related config parameters but unfortunately with little explanation as to what is needed and what is not. I have an ES cluster behind an SSL vip and each node in the cluster is protected at the host level with nginx that requires authentication. The set up works fine from standalone programs running on remote clients so I can query, post and such to the cluster. But having no luck with ES-Hadoop. I must be missing some key config to the ES-Hadop set up with SSL/auth & proxies and such. Here is my set up. The vip/LB is like **[https://vip:443](https://vip:443)** It routes the incoming requests to any one of the esnodes in its pool (esnode\_1 thru esnode\_N) like: **https://esnode\_N:xxx** The above request is fielded by nginx that authenticates the request and routes it **_locally_** to **[http://localhost](http://localhost):yyy** where elasticsearch is running So what combination of parameters in ES-Hadoop do I need to set to get it all to work nicely under ES-Hadoop? I have standalone programs that work fine to write/read from this protected ES cluster, so I know that the set up is sound. I have gotten it to work with setting es.nodes.wan.only =\> true es.net.ssl: =\> true But that is bad for performace! I have tried a variety of combinations trying to avoid the 'wan' option but no dice... es.nodes: the vip ??? Or one of the actual nodes ??? es.port: 443 ??? Or xxx where nginx resolves & authenticates the request on the host, Or yyy where ES actually runs on the host ??? es.net.http.auth.user : service\_user es.net.http.auth.pass: service\_user\_password es.net.proxy.https.user: service\_user ??? this or the above? es.net.proxy.https.pass: service\_user\_password ??? this or the above? es.net.ssl: true ??? Only the proxy & nginx access are ssl... ES is http ... Given that ES-Hadoop tries to talk directly to the shard nodes but access is limited to localhost only or througb the vip... and the port numbers & host/server/vip names are all different Is ES-Hadoop even supposed to work for situations like these, other than using the 'wan' option? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:23pm UTC](https://discuss.elastic.co/t/es-hadoop-config-for-writing-to-es-cluster-behind-a-protected-ssl-vip/60451/4 "2017-07-06T13:23:11Z")