# Esrally-elastic mutual TLS

**URL:** <https://discuss.elastic.co/t/esrally-elastic-mutual-tls/143515>\
**Category:** Elasticsearch\
**Tags:** rally\
**Created:** [August 8, 2018, 12:37pm UTC](https://discuss.elastic.co/t/esrally-elastic-mutual-tls/143515 "2018-08-08T12:37:47Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![dliappis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dliappis/32/56174_2.png) [@dliappis](https://discuss.elastic.co/u/dliappis)\
**Post date:** [August 10, 2018, 3:04pm UTC](https://discuss.elastic.co/t/esrally-elastic-mutual-tls/143515/4 "2018-08-10T15:04:43Z")

</div>

Hey @fara,

Just to be on the safe side are you able to issue:

```auto
curl --cacert /tmp/cacert.pem -u elastic:<yourpassword> https://10.10.10.10:31504

```

Also your `esrally` command is missing the username and password for Rally. It should look like:

```auto
esrally --track=pmc --target-hosts=10.10.10.10:31504 --pipeline=benchmark-only --client-options="use_ssl:true,verify_certs:true,ca_certs:'/tmp/cacert.pem',client_cert:'/tmp/client_cert.pem',client_key:'/tmp/client_key.pem',basic_auth_user:'user',basic_auth_password:'password'"

```

I quickly verified the above command against a simple [TLS enabled cluster in Docker](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls-docker.html) and it worked fine.

Also note (depending on the SSL verification mode value on ES), that you don't always need to specify the client\_key.

Dimitris

---

_[View the full topic](https://discuss.elastic.co/t/esrally-elastic-mutual-tls/143515)._