# Node to node encryption works, but NOT the HTTP client one **URL:** \ **Category:** Elasticsearch\ **Created:** [April 27, 2018, 3:24pm UTC](https://discuss.elastic.co/t/node-to-node-encryption-works-but-not-the-http-client-one/129852 "2018-04-27T15:24:42Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![mlemartien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mlemartien/32/30958_2.png) [@mlemartien](https://discuss.elastic.co/u/mlemartien)\ **Post date:** [April 27, 2018, 3:24pm UTC](https://discuss.elastic.co/t/node-to-node-encryption-works-but-not-the-http-client-one/129852/1 "2018-04-27T15:24:43Z")
Hi there, I have been trying to encrypt communication between the cluster nodes (this works like a charm), the browser and Kibana (works well too) and finally for the HTTP Client traffic. This latter does NOT work. What I did so far: - Generated one PKCS12 certificate per node (3 in totals, 1 of them being a coordinating node only and also running Kibana) - Encryption works well with those certificates with the verification mode to full - Configured kibana.yml to make it point to https://my\_coordinating\_node I keep getting those error messages: {"type":"log","@timestamp":"2018-04-27T15:10:25Z","tags":["warning","elasticsearch","admin"],"pid":28466,"message":"Unable to revive connection: [https://172.28.128.21:9200/](https://172.28.128.21:9200/)"} {"type":"log","@timestamp":"2018-04-27T15:10:25Z","tags":["warning","elasticsearch","admin"],"pid":28466,"message":"No living connections"} In the kibana.stdout log file but the kibana.stderr file remains empty. I have a cluster of 3 nodes: 1 coordinating-only + kibana, 2 master/data I tried so many variations, I am going crazy. Any ideas or leads would be more than welcome! **[My elasticsearch.yml files]** cluster.name: eLABsticsearch node.name: client01 _( or elastic01 or elastic02 )_ node.data: false _( or true for elastic01 and elastic02 )_ node.master: false _( or true for elastic01 and elastic02 )_ node.ingest: false node.ml: false search.remote.connect: false path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: 172.28.128.21 _( or 172.28.128.11 or 172.28.128.12 )_ http.port: 9200 discovery.zen.ping.unicast.hosts: ["172.28.128.11","172.28.128.12"] discovery.zen.minimum\_master\_nodes: 1 xpack.security.transport.ssl.verification\_mode: full xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/${node.name}.p12 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/${node.name}.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: /etc/elasticsearch/${node.name}.p12 xpack.security.http.ssl.truststore.path: /etc/elasticsearch/${node.name}.p12 **[My kibana.yml file]** server.host: "172.28.128.21" elasticsearch.url: "[https://172.28.128.21:9200](https://172.28.128.21:9200)" elasticsearch.username: "kibana" elasticsearch.password: "\*\*\*\*\*\*\*\*" server.ssl.enabled: true server.ssl.certificate: /etc/kibana/client01.crt server.ssl.key: /etc/kibana/client01.key ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 27, 2018, 3:38pm UTC](https://discuss.elastic.co/t/node-to-node-encryption-works-but-not-the-http-client-one/129852/2 "2018-04-27T15:38:31Z")
You need to configure Kibana so that it can trust the certificate that Elasticsearch presents it when attempting to connect via http over TLS. The `p12` keystores that you have created with `certutil` ( I assume ) contain the certificate and private key for the instance, along with the CA certificate. That's why you use it both as a keystore and a truststore in your config. Unfortunately, Kibana doesn't currently support PKCS12 keystores so that you have to export the CA certificate to a pem encoded certificate and use that in your kibana configuration. So in concrete steps: 1. Export the CA certificate from the PKCS12 keystore 2. Copy `elastic-ca.pem` to `/etc/kibana/` 3. Configure kibana to trust this certificate authority by configuring 4. Restart Kibana ---
**Author:** ![mlemartien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mlemartien/32/30958_2.png) [@mlemartien](https://discuss.elastic.co/u/mlemartien)\ **Post date:** [April 27, 2018, 3:54pm UTC](https://discuss.elastic.co/t/node-to-node-encryption-works-but-not-the-http-client-one/129852/3 "2018-04-27T15:54:57Z")
Wow Ionnnis, thank you soooo much. You made my day!!! I have been struggling with this for two days and was getting desperate. I did create the p12 keystores with certutil indeed, but did not know kibana could not use it as-is. Thanks again! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 25, 2018, 3:55pm UTC](https://discuss.elastic.co/t/node-to-node-encryption-works-but-not-the-http-client-one/129852/4 "2018-05-25T15:55:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.