# Marvel and Shield + PKI realm

**URL:** <https://discuss.elastic.co/t/marvel-and-shield-pki-realm/34693>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [November 16, 2015, 3:43pm UTC](https://discuss.elastic.co/t/marvel-and-shield-pki-realm/34693 "2015-11-16T15:43:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hugues\_Bernard](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hugues_bernard/32/5948_2.png) [@Hugues\_Bernard](https://discuss.elastic.co/u/Hugues_Bernard)\
**Post date:** [November 16, 2015, 3:43pm UTC](https://discuss.elastic.co/t/marvel-and-shield-pki-realm/34693/1 "2015-11-16T15:43:39Z")

</div>

Hello all,  
I set-up Shield to use a PKI realm and force both Transport and HTTP to use SSL with **client authentication**. How should I configure the Marvel agent in such case ? Is it even possible to use Marvel with HTTPS and client authentication ?

The Marvel agent, when connecting to the monitoring cluster (same as production in my case), needs to provide a client certificate... But I see no way to define the keystore containing the client certificate to use. The config parameter `marvel.agent.exporter.es.ssl.truststore` contains certificates to trust. But what about the identity certificate ?

Any experience with such a set-up ?  
Note: using Elasticsearch 1.7, Shield 1.3 and Marvel 1.3

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/marvel-and-shield-pki-realm/34693/2 "2017-07-06T13:47:01Z")

</div>

Closed on July 6, 2017, 1:47pm UTC