# How to connect cluster with configured TLS? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, ccr-cross-cluster-replication\ **Created:** [October 27, 2021, 8:15am UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773 "2021-10-27T08:15:40Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Mamol27](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mamol27/32/82016_2.png) [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Post date:** [October 27, 2021, 8:15am UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/1 "2021-10-27T08:15:40Z")
I have two similar clusters with TLS configured on each. What I need to do to connect to each other as remote cluster? Need I add ca to keystore on each node or what? What to do with secured HTTPS traffic? ```auto cluster.name: elk1 node.name: ${HOSTNAME} node.roles: [master, remote_cluster_client] path.data: /opt/elasticsearch/data path.logs: /opt/elasticsearch/logs network.host: 0.0.0.0 http.port: 9200 discovery.seed_hosts: ["172.29.39.141", "172.29.39.142", "172.29.39.143", "172.29.39.144"] cluster.initial_master_nodes: ["172.29.39.141", "172.29.39.142"] action.auto_create_index: .monitoring*,.watches,.triggered_watches,.watcher-history*,.ml* xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.client_authentication: required xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: http.p12 indices.breaker.total.use_real_memory : false ``` ```auto cluster.name: elk2 node.name: ${HOSTNAME} node.roles: [master, remote_cluster_client] path.data: /opt/elasticsearch/data path.logs: /opt/elasticsearch/logs network.host: 0.0.0.0 http.port: 9200 discovery.seed_hosts: ["172.29.39.145", "172.29.39.146", "172.29.39.147", "172.29.39.148"] cluster.initial_master_nodes: ["172.29.39.145", "172.29.39.146"] action.auto_create_index: .monitoring*,.watches,.triggered_watches,.watcher-history*,.ml* xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.client_authentication: required xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: http.p12 indices.breaker.total.use_real_memory : false ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 27, 2021, 8:16am UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/2 "2021-10-27T08:16:12Z")
Connect them for what specifically? ---
**Author:** ![Mamol27](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mamol27/32/82016_2.png) [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Post date:** [October 27, 2021, 8:18am UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/3 "2021-10-27T08:18:26Z")
For bi-directional replication. Does it matter? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 27, 2021, 8:20am UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/4 "2021-10-27T08:20:01Z")
It does, because you originally posted this in the Elastic Security product section, which doesn't really apply to the question. It also adds context 🙂 ---
**Author:** ![Mamol27](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mamol27/32/82016_2.png) [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Post date:** [October 27, 2021, 8:21am UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/5 "2021-10-27T08:21:49Z")
I can't it connect because I have configured security. Without security i had no problems with that. ```auto [2021-10-27T11:23:58,614][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [el1] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=/172.29.39.141:9300, remoteAddress=/172.29.39.145:56270, profile=default} [2021-10-27T11:23:58,619][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [el1] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=/172.29.39.141:9300, remoteAddress=/172.29.39.145:56262, profile=default} ``` Which certificate I need to add where? I don't understand. ---
**Author:** ![Mamol27](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mamol27/32/82016_2.png) [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Post date:** [October 27, 2021, 12:20pm UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/6 "2021-10-27T12:20:25Z")
> **[Configure remote clusters with security | Elasticsearch Guide \[7.15\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-security.html#remote-clusters-security)** Does it mean that I need to use one `elastic-certificates.p12` for each node on both clusters? ---
**Author:** ![AdamWritesDocs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adamwritesdocs/32/88193_2.png) [@AdamWritesDocs](https://discuss.elastic.co/u/AdamWritesDocs)\ **Post date:** [October 27, 2021, 8:50pm UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/7 "2021-10-27T20:50:37Z")
All of the nodes in the local cluster need to trust the nodes in the remote cluster, and vice versa. You need to configure Transport Layer Security (TLS) on every node, which it seems like you have already. You can add the certificates from the local cluster as a trusted CA in each remote cluster. You must also add the certificates from remote clusters as a trusted CA on the local cluster. Using the same CA to generate certificates for all nodes simplifies this task, which is what we recommend in the documentation: [Set up basic security for the Elastic Stack | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 24, 2021, 8:51pm UTC](https://discuss.elastic.co/t/how-to-connect-cluster-with-configured-tls/287773/8 "2021-11-24T20:51:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.