How to create node certificate for Elasticsearch

[aladine (Dan)]

I am using elastic cloud. I have a microservice which connect with elasticsearch cloud with rest api. I want to add SSL to enhance security.

From the documentation, one of the first step is to generate Certificate Authority for each node of cluster. Could someone let me know how to access node to run command bin/elasticsearch-certutil. I am new to ES so I have no idea how to SSH to server.
https://www.elastic.co/guide/en/elasticsearch/reference/6.6/configuring-tls.html#node-certificates

Thanks a lot.

[warkolm (Mark Walkom)]

If you are using Elastic Cloud then it's already got TLS enabled by default, you don't need to do anything other than use the HTTPS port (9243).

[aladine (Dan)]

Thanks @warkolm.

My purpose is to secure the API connection. Currently I am only use basic auth with username and password to connect from client. I already test the client connection with https and it works fine with basic auth.
If TLS is already enabled, how could I restrict the connection to only the application I am building. If I generate a self-signed certificate from client, what I need to change in server configuration to match.

FYI, I try to add this snippet to elasticsearch.yml but failed to update. The error is not allowed :

  xpack.security.http.ssl.enabled: true
  xpack.security.http.ssl.key:  /home/es/config/node01.key 
  xpack.security.http.ssl.certificate: /home/es/config/node01.crt 
  xpack.security.http.ssl.certificate_authorities: [ "/home/es/config/ca.crt" ]

[TimV (Tim Vernum)]

@aladine

My purpose is to secure the API connection

API connections to Elastic Cloud are secured by default. SSL is automatically enabled, and a username + password is required.
What exactly are you looking to do on top of that?

how could I restrict the connection to only the application I am building

That depends on how your application works. Typically you would create a new user for your appllication, and that user's password would be the protection you're after.

FYI, I try to add this snippet to elasticsearch.yml but failed to update. The error is not allowed

Correct. Because Elastic Cloud comes with SSL already enabled, it is not possible to reconfigure this.

[aladine (Dan)]

@TimV

how could I restrict the connection to only the application I am building

That depends on how your application works. Typically you would create a new user for your appllication, and that user's password would be the protection you're after.

Thanks @TimV
Yes, I am using a new user and password with certain permissions.
I just concern if someone has username&password, they can modify the existing Elasticsearch via API call. Or perhaps I am running the application in localhost testing with the existing credentials by mistake.