# HTTPS Client Certificate Only Authentication \[ES 6.8\] \[NEST\] \[SSL/TLS\] **URL:** \ **Category:** Elasticsearch\ **Created:** [June 25, 2019, 2:33am UTC](https://discuss.elastic.co/t/https-client-certificate-only-authentication-es-6-8-nest-ssl-tls/187218 "2019-06-25T02:33:52Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mqb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mqb/32/48653_2.png) [@mqb](https://discuss.elastic.co/u/mqb)\ **Post date:** [June 25, 2019, 2:33am UTC](https://discuss.elastic.co/t/https-client-certificate-only-authentication-es-6-8-nest-ssl-tls/187218/1 "2019-06-25T02:33:52Z")
Is it possible to authenticate with only a self-signed certificate (without basic auth) via NEST 6.x client to an Elasticsearch 6.8 cluster that has SSL/TLS enabled? If so, what are the requirements (ie. subscription level, realm) necessary and is there a NEST code example to establish the connection? NEST client request attempts over HTTPS have resulted in a response back from the ES node indicating a basic authentication credential (user/pass) is required. Sources: " `ClientCertificate` Use a `X509Certificate` to authenticate all HTTP requests. You can also set them on individual request using `ClientCertificates`" -- [Elasticsearch NEST Client Configuration Options Source](https://www.elastic.co/guide/en/elasticsearch/client/net-api/current/configuration-options.html) "[...] one alternative is to use [Public Key Infrastructure (PKI)](https://www.elastic.co/guide/en/elastic-stack-overview/6.5/pki-realm.html) (client certificates) for authenticating to an Elasticsearch cluster." -- [Elastic Blog Source](https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication) " The certificate in this case isn't used for certificate authentication to Elasticsearch, as the `ClientCertificate` method is used for, but is used for Transport Layer Security (TLS)." -- [StackOverflow Source](https://stackoverflow.com/questions/52024259/connect-to-an-azure-hosted-elasticsearch-endpoint-through-a-ssl-offloading-appli/52024455#52024455) The cluster was created using Elastic Azure 6.8 ARM template using Certificates and CA created using Elastic utility tool. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 26, 2019, 3:19am UTC](https://discuss.elastic.co/t/https-client-certificate-only-authentication-es-6-8-nest-ssl-tls/187218/2 "2019-06-26T03:19:01Z")
> [@mqb](#): > > what are the requirements (ie. subscription level, realm) necessary Elasticsearch supports authentication via TLS Client Certificates using the [PKI realm](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/configuring-pki-realm.html), which requires a minimum of a [Gold (or Trial) license](https://www.elastic.co/subscriptions). > [@mqb](#): > > only a self-signed certificate I would discourage the use of a self-signed certificate for this. It would be easier to generate your own CA certificate and use that rather than try and configure PKI with a self-signed client cert. ---
**Author:** ![mqb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mqb/32/48653_2.png) [@mqb](https://discuss.elastic.co/u/mqb)\ **Post date:** [June 26, 2019, 1:47pm UTC](https://discuss.elastic.co/t/https-client-certificate-only-authentication-es-6-8-nest-ssl-tls/187218/3 "2019-06-26T13:47:49Z")
Tim thank you for the additional insights. Seems that there is an info gap or lack of fundamental knowledge on my end regarding the configuration necessary to authentication with just the certificate. The setup is currently designed to use just the enabled ES 6.8 security features (no PKI realm). To confirm, is it possible to authenticate a client (NEST 6.x) by certificate _only_ - not in addition to - removing the need for basic auth credentials? > [@TimV](#): > > It would be easier to generate your own CA certificate and use that We did create a CA cert using the `elasticsearch-certutil` tool which had then been used in the Azure ARM template for environment creation. `/etc/elasticsearch/elasticsearch.yml` ```auto cluster.name: "elasticsearch-tls" node.name: "data-2" path.logs: /var/log/elasticsearch path.data: /datadisks/disk1/elasticsearch/data discovery.zen.ping.unicast.hosts: ["master-0:9300","master-1:9300","master-2:9300"] discovery.zen.minimum_master_nodes: 2 node.master: false node.data: true network.host: [_site_, _local_] node.max_local_storage_nodes: 1 node.attr.fault_domain: 1 node.attr.update_domain: 1 cluster.routing.allocation.awareness.attributes: fault_domain,update_domain azure.client.default.endpoint_suffix: core.windows.net xpack.license.self_generated.type: trial xpack.security.enabled: true bootstrap.memory_lock: true xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: /etc/elasticsearch/ssl/elasticsearch-http.p12 xpack.security.http.ssl.truststore.path: /etc/elasticsearch/ssl/elasticsearch-http.p12 xpack.security.http.ssl.verification_mode: certificate xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/ssl/elasticsearch-transport.p12 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/ssl/elasticsearch-transport.p12 ``` ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 27, 2019, 3:01am UTC](https://discuss.elastic.co/t/https-client-certificate-only-authentication-es-6-8-nest-ssl-tls/187218/4 "2019-06-27T03:01:35Z")
> [@mqb](#): > > To confirm, is it possible to authenticate a client (NEST 6.x) by certificate _only_ - not in addition to - removing the need for basic auth credentials? It is certainly possible to authenticate "a client" by certificate only. I cannot see a reason why that would not be possible in NEST, but I'm not a .NET engineer, so I've never done it myself. The high level steps you need are: 1. Turn on client authentication for HTTP. e.g. ```auto xpack.security.http.ssl.client_authentication: optional ``` 2. Enable a PKI Realm: ```auto xpack.security.authc.realms: file1: type: file order: 1 native1: type: native order: 2 pki1: type: pki order: 3 ``` 3. Connect using a client certificate that is trusted by your HTTP ssl config (in this case, a certificate that was signed by the same CA as you used to generate `elasticsearch-http.p12`) ---
**Author:** ![forloop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/forloop/32/9021_2.png) [@forloop](https://discuss.elastic.co/u/forloop)\ **Post date:** [July 1, 2019, 2:42am UTC](https://discuss.elastic.co/t/https-client-certificate-only-authentication-es-6-8-nest-ssl-tls/187218/5 "2019-07-01T02:42:01Z")
With NEST or [Elasticsearch.Net](http://Elasticsearch.Net), you can use a certificate for authentication by using the `.ClientCertificate(...)` method on `ConnectionSettings`/`ConnectionConfiguration`, respectively. For example, ```auto var settings = new ConnectionSettings(pool) .ClientCertificate(@"C:\path_to_cert"); var client = new ElasticClient(settings); ``` or if you need more control over how an `X509Certificate` instance is created ```auto var settings = new ConnectionSettings(pool) .ClientCertificate(new X509Certificate2(@"C:\path_to_cert")); var client = new ElasticClient(settings); ``` Take a look at the [.NET client documentation on Client Certificates](https://www.elastic.co/guide/en/elasticsearch/client/net-api/current/working-with-certificates.html#_client_certificates). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 29, 2019, 2:42am UTC](https://discuss.elastic.co/t/https-client-certificate-only-authentication-es-6-8-nest-ssl-tls/187218/6 "2019-07-29T02:42:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.