# HIPAA Compliant Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [July 16, 2015, 12:32am UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch/25678 "2015-07-16T00:32:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![James\_Wu](https://avatars.discourse-cdn.com/v4/letter/j/8c91f0/32.png) [@James\_Wu](https://discuss.elastic.co/u/James_Wu)\ **Post date:** [July 16, 2015, 12:32am UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch/25678/1 "2015-07-16T00:32:30Z")
Will using nginx as a reverse proxy be enough to ensure that node to node communication is encrypted? If so, then why would [Add SSL support to Netty transport layer for Client/Node-to-Node communication by tlrx · Pull Request #2105 · elastic/elasticsearch · GitHub](https://github.com/elasticsearch/elasticsearch/pull/2105) as mentioned by Paul Brown and [GitHub - sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty) be necessary? If not, then what is the point of [Authentication | Elasticsearch JavaScript Client [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/client/javascript-api/current/auth-reference.html) Thanks for any information that you can help out with. Continuing the discussion from [HIPAA compliant ElasticSearch application](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch-application/13417/4): > [@HIPAA compliant ElasticSearch application](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch-application/13417/4): > > Hi, Charitha -- > > You'll need to secure both the transport to the cluster (e.g., with HTTPS as some other posters suggested) and the internal transport within the cluster; see, e.g., [Add SSL support to Netty transport layer for Client/Node-to-Node communication by tlrx · Pull Request #2105 · elastic/elasticsearch · GitHub](https://github.com/elasticsearch/elasticsearch/pull/2105). > > — > [prb@mult.ifario.us](mailto:prb@mult.ifario.us) | Multifarious, Inc. | [http://mult.ifario.us/](http://mult.ifario.us/) > > On August 30, 2013 at 4:31:30 PM, Charitha Sathkumara ([srilankanchurro@gmail.com](mailto:srilankanchurro@gmail.com)) wrote: > > I am trying to implement a logging solution as part of an application that handles sensitive medical data. I intend on using Elasticsearch + [Searchbox.io](http://Searchbox.io) Jest for storage and retrieval of this data. > > HIPAA rules state that I must ensure that communications between my application server and elasticsearch server are encrypted. > > ## How would I go about protecting an Elasticsearch server and communications between the server and the Jest client? Any resources/tutorials/ideas would be much appreciated. > > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 16, 2015, 3:50am UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch/25678/2 "2015-07-16T03:50:14Z")
> Will using nginx as a reverse proxy be enough to ensure that node to node communication is encrypted? No. Node to node communication doesn't go over HTTP(S) but over a custom protocol. > If not, then what is the point of [Authentication | Elasticsearch JavaScript Client [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/client/javascript-api/current/auth-reference.html) Not sure what you mean. That's the JavaScript _client library_ and its abilities to use HTTPS and authentication, which is useful regardless of whether you run nginx or not and has nothing to do with node to node communication. ---
**Author:** ![James\_Wu](https://avatars.discourse-cdn.com/v4/letter/j/8c91f0/32.png) [@James\_Wu](https://discuss.elastic.co/u/James_Wu)\ **Post date:** [July 16, 2015, 4:20am UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch/25678/3 "2015-07-16T04:20:37Z")
Thanks for replying. Does this mean that even though the javascript client library has the ability to use HTTPS, elasticsearch does not support client-server HTTPS unless you use shield or nginx or [https://github.com/sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty)? That is my current understanding of what is happening. As for node to node encryption, is [https://github.com/sonian/elasticsearch-jetty](https://github.com/sonian/elasticsearch-jetty) a solution? What are other options? I see vague references to stunnel and ipsec, but nothing concrete and definitive. There surely was a solution before shield was released. Are there any good explanations of the custom protocol used for node to node communication? All I can see is that it binds to a port in the range of 9300 to 9400. ---
**Author:** ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)\ **Post date:** [July 16, 2015, 6:53am UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch/25678/4 "2015-07-16T06:53:58Z")
elasticsearch-jetty does not provide security. Node-to-node TLS is availabe in Shield, e.g. [https://www.elastic.co/guide/en/shield/current/separating-node-client-traffic.html](https://www.elastic.co/guide/en/shield/current/separating-node-client-traffic.html) Note, even with Shield, you must maintain host keys and/or truststore/keystore on each node for TLS, which is not secure if the node is not running in a secure environment controlled by yourself like a physical machine in your private network in your data center. ---
**Author:** ![James\_Wu](https://avatars.discourse-cdn.com/v4/letter/j/8c91f0/32.png) [@James\_Wu](https://discuss.elastic.co/u/James_Wu)\ **Post date:** [July 16, 2015, 9:05pm UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch/25678/5 "2015-07-16T21:05:26Z")
Thanks, are there any vulnerabilities to running using nginx as a reverse proxy for client-server communication for a single node elasticsearch setup? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:00am UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch/25678/6 "2017-07-06T00:00:56Z")