# How to Configure SSL/TLS Certificates for ECK-Managed Elasticsearch to Connect External Elastic Agent and Logstash

**URL:** https://discuss.elastic.co/t/how-to-configure-ssl-tls-certificates-for-eck-managed-elasticsearch-to-connect-external-elastic-agent-and-logstash/370451
**Category:** Elastic Search
**Created:** [November 13, 2024, 2:38am UTC](https://discuss.elastic.co/t/how-to-configure-ssl-tls-certificates-for-eck-managed-elasticsearch-to-connect-external-elastic-agent-and-logstash/370451 "2024-11-13T02:38:13Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![wangsubo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wangsubo/32/133865_2.png) [@wangsubo](https://discuss.elastic.co/u/wangsubo)
#### Post date: [November 13, 2024, 2:38am UTC](https://discuss.elastic.co/t/how-to-configure-ssl-tls-certificates-for-eck-managed-elasticsearch-to-connect-external-elastic-agent-and-logstash/370451/1 "2024-11-13T02:38:13Z")

</div>

I have an Elasticsearch cluster deployed using Elastic Cloud on Kubernetes (ECK). Currently, I have an Elastic Agent on an external virtual machine (192.168.1.4) that sends data to Logstash (192.168.1.4:5044), and Logstash then forwards this data to the internally deployed ECK Elasticsearch cluster.

From what I understand, the Elasticsearch instance deployed by ECK does not include a CA private key by default. To configure SSL/TLS for the Logstash output, how can I generate additional certificates within ECK Elasticsearch so that the external Elastic Agent and Logstash can securely communicate with the ECK Elasticsearch cluster?

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [November 13, 2024, 3:13am UTC](https://discuss.elastic.co/t/how-to-configure-ssl-tls-certificates-for-eck-managed-elasticsearch-to-connect-external-elastic-agent-and-logstash/370451/2 "2024-11-13T03:13:14Z")

</div>

For external connections to my ECK hosted Elasticsearch cluster, I use an Ingress with a TLS certificate (I use Let's Encrypt + `cert-manager` to automate creation and renewal).

```auto
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "360"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "360"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "360"
    nginx.ingress.kubernetes.io/proxy-ssl-verify: "off"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
  - host: SUB.DOMAIN.TLD
    http:
      paths:
      - backend:
          service:
            name: MY_SVC_NAME
            port:
              number: 9200
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - SUB.DOMAIN.TLD
    secretName: MY_SECRET_NAME

```

Where:

- `SUB.DOMAIN.TLD` = the host name to be secured (which your Logstash will point to as part of the URL)
- `MY_SVC_NAME` = whatever your Elasticsearch service short name is. It should be `${metadata.name}-es-http`
- `MY_SECRET_NAME` = arbitrary, if using `cert-manager`, otherwise it needs to be the name of an existing TLS certificate valid for `SUB.DOMAIN.TLD`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 11, 2024, 3:13am UTC](https://discuss.elastic.co/t/how-to-configure-ssl-tls-certificates-for-eck-managed-elasticsearch-to-connect-external-elastic-agent-and-logstash/370451/3 "2024-12-11T03:13:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.