# /etc/elasticsearch/trust.yml is mandatory and optional. I am using it On-Premises **URL:** \ **Category:** Elasticsearch\ **Created:** [October 10, 2025, 6:00pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591 "2025-10-10T18:00:50Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Varinder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varinder/32/123243_2.png) [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Post date:** [October 10, 2025, 6:00pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591/1 "2025-10-10T18:00:51Z")
Hi Folks, Thanks to all members for their help and support. I need opinion for both **Single Node and Cluster in Elasticsearch.** “Is not using the **/etc/elasticsearch/trust.yml** file in **/etc/elasticsearch/elasticsearch.yml** and not creating it in as **/etc/elasticsearch/trust.yml** considered a significant security risk? What are the potential implications of omitting it in a cluster environment? In my current setup, I’m not using this file, and the cluster is still forming successfully — does this pose any operational or security concerns?” Is it a **mandatory field or Optional**? What if I dont use it? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 10, 2025, 8:24pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591/2 "2025-10-10T20:24:29Z")
@Varinder What version are you on? > [@Varinder](#): > > I need opinion for both **Single Node and Cluster in Elasticsearch.** > > “Is not using the **/etc/elasticsearch/trust.yml** file in **/etc/elasticsearch/elasticsearch.yml** and not creating it in as **/etc/elasticsearch/trust.yml** considered a significant security risk? No, no security risk. That file is only used when connecting to remote clusters AND that method is now depreciated. That file is only used if you define it with the following which is only used connecting with remote clusters `xpack.security.transport.ssl.trust_restrictions.path` So tl;dr; you are fine leaving it out ---
**Author:** ![Varinder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varinder/32/123243_2.png) [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Post date:** [October 11, 2025, 6:01pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591/3 "2025-10-11T18:01:34Z")
Hi @stephenb , Thanks for your valuable answer. I am on ES 8.19.3 Now ES cluster is forming without any issue. Do I need to execute step 5 or it optional/redundant? ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/4/5421728afa079ac8daddac4afe1e61805150d322.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 11, 2025, 6:23pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591/4 "2025-10-11T18:23:44Z")
What documents are you following? And what version of the stack are they supposed to be for? I do not recognize that document Here are the official settings for [transport ssl](https://www.elastic.co/guide/en/elasticsearch/reference/8.19/security-settings.html#transport-tls-ssl-settings) for 8.19 ---
**Author:** ![Varinder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varinder/32/123243_2.png) [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Post date:** [October 11, 2025, 6:48pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591/5 "2025-10-11T18:48:05Z")
Actually this is not any official document. Just 1 document from my company. I am verifying this document by my own research ( searching on ES documentation then by testing). “This configuration I am asking about is for Elasticsearch 8.19.3.” ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 11, 2025, 6:58pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591/6 "2025-10-11T18:58:31Z")
> [@Varinder](#): > > Actually this is not any official document. Just 1 document from my company. I am verifying this document by my own research ( searching on ES documentation then by testing). > > “This configuration I am asking about is for Elasticsearch 8.19.3.” Really hard for us to comment on the correctness of external documents, especially when we only see tiny selected pieces. As I mentioned that setting does not even exist in documented setting for 8.19 from our official documentation that I shared above. That is not a normal part of a normal installation. Perhaps your company has some very specific requirements for very specific versions, which I can not comment on. Normal Good Certificate hygiene is most important. ---
**Author:** ![Varinder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varinder/32/123243_2.png) [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Post date:** [October 11, 2025, 7:04pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591/7 "2025-10-11T19:04:50Z")
Thank you, Stephen — really appreciate your clarification. I see your point. Yes, this is indeed an internal company document, and I completely understand that it’s hard to comment on third-party or partial snippets. I’m currently verifying it on my own by comparing every setting with the official 8.19.3 documentation and also testing it directly on my environment. Your note about proper certificate hygiene is so true — I will make sure to align the configuration with the documented and supported settings for ES 8.19.3. Thanks again for your knowledge and guidance. I really appreciate this.