# Https:9200 without user/password and certificate
**URL:** https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514
**Category:** Elasticsearch
**Created:** [June 14, 2024, 4:46pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514 "2024-06-14T16:46:59Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [June 14, 2024, 4:46pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514/1 "2024-06-14T16:46:59Z")
Can I setup elasticsearch, so I can use curl like this
`curl https://server:9200`
if yes what are the settings in yml
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 14, 2024, 4:54pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514/2 "2024-06-14T16:54:16Z")
Hi @elasticforme
HTTPS by definition requires a CA and TLS certificate for elasticsearch.
Are you asking if you then can curl without providing a CA?
If that the question.
The answer to that is Yes provided
1. the certificates are publicly signed and trusted
2. If self signed / corporate signed the CA would need to be instead in the host's trust store.
With respect to HTTPS and no u/p would need to check I am not sure that is a valid config... Certainly unusual... Encrypt traffic but no login ...what is the point?
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [June 14, 2024, 5:18pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514/3 "2024-06-14T17:18:08Z")
ok so I can use
curl -k to ignore providing certificate but how do I disable user/password?
what is the point? i don't know at this time either. few people testing something and I am helping on elastic side.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 14, 2024, 5:37pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514/4 "2024-06-14T17:37:14Z")
Why not just turn off all security then...
`xpack.security.enabled: false`
You will need to test. I'm not at my desk to test the configuration you want.
Yes the `-k` to ignore cert check
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [June 14, 2024, 5:38pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514/5 "2024-06-14T17:38:26Z")
I already did disable whole security, and it work.
but they want to test https:9200 without username/password
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 14, 2024, 5:41pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514/6 "2024-06-14T17:41:03Z")
Like I said I'm away from the keyboard...
Did you try leaving the http ssl enabled with the settings...
```auto
xpack.security.http.ssl:
enabled: true
....
```
With the other setting off?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 14, 2024, 5:43pm UTC](https://discuss.elastic.co/t/https-9200-without-user-password-and-certificate/361514/7 "2024-06-14T17:43:14Z")
You should be able to do that by [configuring anonymous access](https://www.elastic.co/guide/en/elasticsearch/reference/8.14/anonymous-access.html).