# How to secure communication between APM agent and APM server? **URL:** \ **Category:** APM\ **Tags:** java, server\ **Created:** [January 19, 2021, 10:53am UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527 "2021-01-19T10:53:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [January 19, 2021, 10:53am UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/1 "2021-01-19T10:53:33Z")
I want to avoid that anyone can send anything to APM server port. Do you have any experience in this case? I case of communication between APM server and ELK we are using ssl certificates. Best Regads, Dan ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [January 19, 2021, 10:58am UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/2 "2021-01-19T10:58:46Z")
APM server can : - Communicate with Elasticsearch using SSL/TLS - SSL/TLS can be enabled in input combined with APIkey Authentification, so any agent need to send a token and use SSL/TLS to talk to APM server > **[SSL input settings | APM Server Reference \[7.10\] | Elastic](https://www.elastic.co/guide/en/apm/server/current/agent-server-ssl.html)** What agent are you using ? I used many time java agent to talk with APM server in SSL > **[SSL/TLS communication with APM Server | APM Java Agent Reference \[1.x\] | Elastic](https://www.elastic.co/guide/en/apm/agent/java/current/ssl-configuration.html)** ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [January 19, 2021, 11:03am UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/3 "2021-01-19T11:03:33Z")
Hi @ylasri, We are using java agent. Could you show me your example configuration for agent and server with SSL between them, please? Thanks ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [January 19, 2021, 12:54pm UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/4 "2021-01-19T12:54:04Z")
Yes sure, i will share with you a full example ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [January 19, 2021, 12:57pm UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/5 "2021-01-19T12:57:34Z")
I'll be wait. Thanks a lot. ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [January 19, 2021, 2:12pm UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/6 "2021-01-19T14:12:17Z")
Here is the config i'm using - At the APM server level (apm-server.yml), I'm using PEM format ```auto ssl: enabled: true # Path to file containing the certificate for server authentication. # Needs to be configured when ssl is enabled. certificate: '/es/apm-server/apm-server.crt' # Path to file containing server certificate key. # Needs to be configured when ssl is enabled. key: '/es/apm-server/apm-server.key' # Optional configuration options for ssl communication. # Passphrase for decrypting the Certificate Key. # It is recommended to use the provided keystore instead of entering the passphrase in plain text. key_passphrase: 'truststore_password' # List of supported/valid protocol versions. By default TLS versions 1.1 up to 1.3 are enabled. supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3] ``` At the agent level, i'm converting to PKC12 format, i'm using this batch on windows to run my java app ```auto setlocal set APP_ARGS=-javaagent:../lib/elastic-apm-agent-1.18.1.jar set APP_ARGS=%APP_ARGS% -Delastic.apm.service_name=my-service-name set APP_ARGS=%APP_ARGS% -Delastic.apm.application_packages=* set APP_ARGS=%APP_ARGS% -Delastic.apm.server_urls=https://my-apm-server:8200 set APP_ARGS=%APP_ARGS% -Delastic.apm.environment=Production set APP_ARGS=%APP_ARGS% -Delastic.apm.enable_log_correlation=true set APP_ARGS=%APP_ARGS% -Djavax.net.ssl.keyStore=apm-server.p12 set APP_ARGS=%APP_ARGS% -Djavax.net.ssl.keyStoreType=pkcs12 set APP_ARGS=%APP_ARGS% -Djavax.net.ssl.keyStorePassword=truststore_password set APP_ARGS=%APP_ARGS% -Delastic.apm.verify_server_cert=true java %APP_ARGS% -jar target\car-back-end-1.1.jar ``` But in order that the agent trust the server, you need to add the PEM certificate into the JVM truststore as descibed in bellow doc > **[SSL/TLS communication with APM Server | APM Java Agent Reference \[1.x\] | Elastic](https://www.elastic.co/guide/en/apm/agent/java/current/ssl-configuration.html#ssl-configuration)** ---
**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Post date:** [January 19, 2021, 2:53pm UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/7 "2021-01-19T14:53:51Z")
@ylasri Thanks a lot, I'll test such configuration. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 9, 2021, 10:53am UTC](https://discuss.elastic.co/t/how-to-secure-communication-between-apm-agent-and-apm-server/261527/8 "2021-02-09T10:53:58Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.