# Mutual tls/ssl on elasticsearch **URL:** \ **Category:** Elastic Security\ **Tags:** elastic-stack-security\ **Created:** [October 19, 2020, 8:15am UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502 "2020-10-19T08:15:59Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 20, 2020, 11:35am UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/21 "2020-10-20T11:35:00Z")
Server sends ```auto *** CertificateRequest ``` and client replies with the certificate ```auto *** Certificate chain chain [0] = [ [ Version: V3 Subject: CN=instance Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 .... ``` and server trusts it ```auto *** Found trusted certificate: ``` That shows that your client is still sending the certificate so we should focus on this. I unfortunately have no other ideas about winSSL/schannel and why it automatically picks up the certificate, or how you'd stop it from doing so. ---
**Author:** ![Daniel\_Schneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_schneider/32/77408_2.png) [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\ **Post date:** [October 20, 2020, 11:40am UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/22 "2020-10-20T11:40:47Z")
It cannot be cookies, since I tried different clients, like command prompt, as well as IE and Chrome in private mode. Am I right? ---
**Author:** ![Daniel\_Schneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_schneider/32/77408_2.png) [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\ **Post date:** [October 20, 2020, 12:39pm UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/23 "2020-10-20T12:39:39Z")
It seems that you are right. WinSSL indeed sends client certificate automatically. > > > The following issue was reported in the repo for the libcurl bindings for the R programming language. > Earlier this year we switched... Unfortunately CURL did not fix it yet: (15.3 Add option to disable client certificate auto-send) > **[curl - TODO](https://curl.haxx.se/docs/todo.html)** Thank you and your colleague for fast and comprehensive responses. Such high level of professional support is not at all obvious in itself. Have a nice day 🙂 ---
**Author:** ![dzyubanv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dzyubanv/32/24110_2.png) [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Post date:** [October 20, 2020, 8:32pm UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/24 "2020-10-20T20:32:14Z")
Daniel, you might look at [Testing TLS/SSL secured elastic cluster](https://discuss.elastic.co/t/testing-tls-ssl-secured-elastic-cluster/250572/22) Ii is about setup/configuration ES-7.8.0 fully x-pack secured cluster on RHEL with TLS/SSL on transport and http layers and tested it successfully with CURL and simple java client based on JEST API. ---
**Author:** ![Daniel\_Schneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_schneider/32/77408_2.png) [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\ **Post date:** [October 20, 2020, 11:05pm UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/25 "2020-10-20T23:05:26Z")
Thank you very much, Vadim. Appreciate your help. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 21, 2020, 5:12am UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/26 "2020-10-21T05:12:01Z")
Just for clarity: Although Vadim's setup is definitely a good reference, the problem that Daniel has here is that CURL in his environment ( Windows ) is automatically sending client certificates even when it's not asked to, and unfortunately no amount of configuration on elasticsearch's side can fix that. ---
**Author:** ![Daniel\_Schneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_schneider/32/77408_2.png) [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\ **Post date:** [October 21, 2020, 10:15am UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/27 "2020-10-21T10:15:13Z")
By the way. If instead of CURL you use web browser like IE or Chrome, everything works fine. You are prompted by the browser to select certificate for authentication of yourself to ES server and after that SSL handshake including verification of ES server DNS succeeds without any problems. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 8:15am UTC](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502/29 "2022-11-04T08:15:40Z")
Closed on November 4, 2022, 8:15am UTC [Previous page](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502.md?page=1)