# Keystore need help **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 21, 2015, 1:51pm UTC](https://discuss.elastic.co/t/keystore-need-help/25988 "2015-07-21T13:51:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![quejinho](https://avatars.discourse-cdn.com/v4/letter/q/3bc359/32.png) [@quejinho](https://discuss.elastic.co/u/quejinho)\ **Post date:** [July 21, 2015, 1:51pm UTC](https://discuss.elastic.co/t/keystore-need-help/25988/1 "2015-07-21T13:51:03Z")
My english is quite bad. I need a bit of help with creating the secure connection with keystore from my logstash -\> transport -\> shield . Without doing anything with CA how is it possible ? Can someone guide me with it ? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 21, 2015, 4:31pm UTC](https://discuss.elastic.co/t/keystore-need-help/25988/2 "2015-07-21T16:31:17Z")
Hi, We don't recommend using self signed certificates because it means that in order to add a new node, you will need to perform a full cluster restart. This will not allow you to scale in production and can actually require you to perform more steps than using a CA. You can generate your own CA and perform the steps in the documentation. I'd first start with getting SSL setup for elasticsearch with Shield and then the steps for logstash should be generating the certificate, signing it with the same CA, and ensuring the that the CA's certificate is trusted by logstash. Elasticsearch with Shield should trust the signed certificate. Jay ---
**Author:** ![quejinho](https://avatars.discourse-cdn.com/v4/letter/q/3bc359/32.png) [@quejinho](https://discuss.elastic.co/u/quejinho)\ **Post date:** [July 22, 2015, 7:49am UTC](https://discuss.elastic.co/t/keystore-need-help/25988/4 "2015-07-22T07:49:27Z")
thx will try again. though that x509 will be enough. hope to have good news tommorow. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 22, 2015, 11:30am UTC](https://discuss.elastic.co/t/keystore-need-help/25988/5 "2015-07-22T11:30:12Z")
Which documentation did you follow? The missing piece to me is the CA configuration; your openssl commands look like they don't specify the config and you also need to use `openssl ca` instead of `openssl x509` when signing the CSR. Take a look at [https://www.elastic.co/guide/en/shield/current/certificate-authority.html](https://www.elastic.co/guide/en/shield/current/certificate-authority.html) ---
**Author:** ![quejinho](https://avatars.discourse-cdn.com/v4/letter/q/3bc359/32.png) [@quejinho](https://discuss.elastic.co/u/quejinho)\ **Post date:** [July 23, 2015, 6:04am UTC](https://discuss.elastic.co/t/keystore-need-help/25988/7 "2015-07-23T06:04:33Z")
After couple of times. it started to work. Thank You very much for Your help. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 23, 2015, 12:12pm UTC](https://discuss.elastic.co/t/keystore-need-help/25988/8 "2015-07-23T12:12:18Z")
Glad to hear you got it working. Please do let us know if you have any issues or more questions. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/keystore-need-help/25988/9 "2017-07-06T13:48:46Z")