# Only expose HTTPS

**URL:** <https://discuss.elastic.co/t/only-expose-https/153214>\
**Category:** Elasticsearch\
**Created:** [October 19, 2018, 6:48pm UTC](https://discuss.elastic.co/t/only-expose-https/153214 "2018-10-19T18:48:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rossbeehler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossbeehler/32/36726_2.png) [@rossbeehler](https://discuss.elastic.co/u/rossbeehler)\
**Post date:** [October 19, 2018, 6:48pm UTC](https://discuss.elastic.co/t/only-expose-https/153214/1 "2018-10-19T18:48:38Z")

</div>

I am trialing the x-pack security feature through the [docker.elastic.co/elasticsearch/elasticsearch:6.4.2](http://docker.elastic.co/elasticsearch/elasticsearch:6.4.2) container image and have followed the [Configuring TLS](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/configuring-tls.html) documentation, but after starting elasticsearch, I can only locally (on the container) curl using http, and not https.

Here's my elasticsearch.yaml:

```
cluster.name: full-stack-cluster
node.name: node-1
path.data: /usr/share/elasticsearch/data
http:
  host: 0.0.0.0
  port: 9200
bootstrap.memory_lock: true
transport.host: 127.0.0.1
xpack.security.enabled: true
xpack.security.audit.enabled: true
xpack.security.audit.outputs: logfile
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate 
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certificates/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certificates/elastic-certificates.p12
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certificates/elastic-certificates.p12
xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certificates/elastic-certificates.p12

```

I have verified that "/usr/share/elasticsearch/config/certificates/elastic-certificates.p12" is a working link.

Here's what I see when I curl http:

```
[root@elasticsearch-deployment-5dbffd949f-wjdkn elasticsearch]# curl http://localhost:9200
{
  "name" : "d9Nsd1R",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "hPVfPKydQt2-2xG8hDwRyw",
  "version" : {
    "number" : "6.4.2",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "04711c2",
    "build_date" : "2018-09-26T13:34:09.098244Z",
    "build_snapshot" : false,
    "lucene_version" : "7.4.0",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

```

Here's what I see when i curl https:

```
[root@elasticsearch-deployment-5dbffd949f-wjdkn elasticsearch]# curl https://localhost:9200
curl: (35) SSL received a record that exceeded the maximum permissible length.

```

As a secondary question, how do I know this is working for tcp? I've ramped up the log level in log4j2.properties to debug, and I see nothing about ssl/tls/certs, and very, very little about x-pack security. Is there some way to know that tls is appropriately configured for elasticsearch?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [October 19, 2018, 7:07pm UTC](https://discuss.elastic.co/t/only-expose-https/153214/2 "2018-10-19T19:07:03Z")

</div>

You might have a basic license, which is the default type for a self generated license. You can use the start trial API to upgrade to a trial license, which allows security. [https://www.elastic.co/guide/en/elastic-stack-overview/current/license-management.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/license-management.html)

Or you can set `xpack.license.self_generated.type: 'trial'` in your elasticsearch.yml file.

---

<div class="post-metadata">

**Author:** ![rossbeehler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossbeehler/32/36726_2.png) [@rossbeehler](https://discuss.elastic.co/u/rossbeehler)\
**Post date:** [October 19, 2018, 7:16pm UTC](https://discuss.elastic.co/t/only-expose-https/153214/3 "2018-10-19T19:16:04Z")

</div>

Thanks jaymode.

I tried adding that to my elasticsearch.yml, and it didn't appear to help. When I grep the logs, I do see the following info about my license, which appears like the trial isn't engaging. Any ideas?

[2018-10-19T19:11:56,519][DEBUG][o.e.l.LicenseService] [d9Nsd1R] current [LicensesMetaData{license={"uid":"d020c18b-50f6-45c9-8b94-eb86424e1b00","type":"basic","issue\_date\_in\_millis":1539634706699,"max\_nodes":1000,"issued\_to":"docker-cluster","issuer":"elasticsearch","signature":redacted,"start\_date\_in\_millis":-1}, trialVersion=null}]

Is there something else I can look at to see that it is properly reading my elasticsearch.yml file?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [October 19, 2018, 7:34pm UTC](https://discuss.elastic.co/t/only-expose-https/153214/4 "2018-10-19T19:34:06Z")

</div>

I think you will need to use the start trial api since the license has already been generated. Sorry about that.

---

<div class="post-metadata">

**Author:** ![rossbeehler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossbeehler/32/36726_2.png) [@rossbeehler](https://discuss.elastic.co/u/rossbeehler)\
**Post date:** [October 19, 2018, 8:01pm UTC](https://discuss.elastic.co/t/only-expose-https/153214/5 "2018-10-19T20:01:34Z")

</div>

Thanks jaymode. I got that rolling and started using the API to find a lot more evidence that my elasticsearch.yml file was not getting picked up. Note that I'm hosting this in kubernetes, and my kubernetes manifest has been pieced together from a couple different places, which I believe had my elasticsearch.yml going to the wrong directory. I've fixed that and now I can see it's working much better.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 21, 2018, 3:18am UTC](https://discuss.elastic.co/t/only-expose-https/153214/6 "2018-10-21T03:18:29Z")

</div>

> [@rossbeehler](#):
>
> Is there something else I can look at to see that it is properly reading my elasticsearch.yml file?

It doesn't look like your config file is being used.

```auto
cluster.name: full-stack-cluster
node.name: node-1

```

```auto
  "name" : "d9Nsd1R",
  "cluster_name" : "docker-cluster",

```

How are you providing that yml config to the container?  
Are you following one of the options given here?

- [Install Elasticsearch with Docker | Elasticsearch Guide [6.4] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/docker.html#docker-configuration-methods)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2018, 3:18am UTC](https://discuss.elastic.co/t/only-expose-https/153214/7 "2018-11-18T03:18:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.