# How to create node certificate for Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 25, 2019, 12:57am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658 "2019-03-25T00:57:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![aladine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aladine/32/42201_2.png) [@aladine](https://discuss.elastic.co/u/aladine)\ **Post date:** [March 25, 2019, 12:57am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658/1 "2019-03-25T00:57:40Z")
I am using elastic cloud. I have a microservice which connect with elasticsearch cloud with rest api. I want to add SSL to enhance security. From the documentation, one of the first step is to generate Certificate Authority for each node of cluster. Could someone let me know how to access node to run command bin/elasticsearch-certutil. I am new to ES so I have no idea how to SSH to server. [https://www.elastic.co/guide/en/elasticsearch/reference/6.6/configuring-tls.html#node-certificates](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/configuring-tls.html#node-certificates) Thanks a lot. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 25, 2019, 12:59am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658/2 "2019-03-25T00:59:28Z")
If you are using Elastic Cloud then it's already got TLS enabled by default, you don't need to do anything other than use the HTTPS port (9243). ---
**Author:** ![aladine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aladine/32/42201_2.png) [@aladine](https://discuss.elastic.co/u/aladine)\ **Post date:** [March 25, 2019, 1:08am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658/3 "2019-03-25T01:08:08Z")
Thanks @warkolm. My purpose is to secure the API connection. Currently I am only use basic auth with username and password to connect from client. I already test the client connection with https and it works fine with basic auth. If TLS is already enabled, how could I restrict the connection to only the application I am building. If I generate a self-signed certificate from client, what I need to change in server configuration to match. FYI, I try to add this snippet to elasticsearch.yml but failed to update. The error is _not allowed_ : ``` xpack.security.http.ssl.enabled: true xpack.security.http.ssl.key: /home/es/config/node01.key xpack.security.http.ssl.certificate: /home/es/config/node01.crt xpack.security.http.ssl.certificate_authorities: ["/home/es/config/ca.crt"] ``` ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 25, 2019, 2:01am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658/4 "2019-03-25T02:01:56Z")
> [@aladine](#): > > My purpose is to secure the API connection API connections to Elastic Cloud are secured by default. SSL is automatically enabled, and a username + password is required. What _exactly_ are you looking to do on top of that? > [@](#): > > how could I restrict the connection to only the application I am building That depends on how your application works. Typically you would create a new user for your appllication, and that user's password would be the protection you're after. > [@](#): > > FYI, I try to add this snippet to elasticsearch.yml but failed to update. The error is _not allowed_ Correct. Because Elastic Cloud comes with SSL already enabled, it is not possible to reconfigure this. ---
**Author:** ![aladine](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aladine/32/42201_2.png) [@aladine](https://discuss.elastic.co/u/aladine)\ **Post date:** [March 25, 2019, 2:11am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658/5 "2019-03-25T02:11:56Z")
> [@TimV](#): > > > how could I restrict the connection to only the application I am building > > That depends on how your application works. Typically you would create a new user for your appllication, and that user's password would be the protection you're after. Thanks @TimV Yes, I am using a new user and password with certain permissions. I just concern if someone has username&password, they can modify the existing Elasticsearch via API call. Or perhaps I am running the application in localhost testing with the existing credentials by mistake. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 22, 2019, 2:11am UTC](https://discuss.elastic.co/t/how-to-create-node-certificate-for-elasticsearch/173658/6 "2019-04-22T02:11:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.