# PKI authentication with shield - client certificate not requested

**URL:** <https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [July 31, 2016, 3:25pm UTC](https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830 "2016-07-31T15:25:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elad\_Benedict](https://avatars.discourse-cdn.com/v4/letter/e/b19c9b/32.png) [@Elad\_Benedict](https://discuss.elastic.co/u/Elad_Benedict)\
**Post date:** [July 31, 2016, 3:25pm UTC](https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830/1 "2016-07-31T15:25:58Z")

</div>

Hi,

I'm trying to configure shield with PKI user authentication.  
SSL seems to be configured and working properly (e.g. I can query over https).

When I configure a realm chain with PKI it appears that a client certificate is **not requested** during the SSL handshake. Any idea what might be causing it?

This is my elasticsearch.yml:

script.engine.groovy.inline.aggs: on  
shield.ssl.keystore.path: C:\elasticsearch-2.3.3\elasticsearch-2.3.3\config\shield\keyStore.jks  
shield.ssl.keystore.password: password  
shield.ssl.truststore.path: C:\elasticsearch-2.3.3\elasticsearch-2.3.3\config\shield\keyStore.jks  
shield.ssl.truststore.password: password  
shield.transport.ssl : true  
shield.http.ssl: true  
shield.authc:  
realms:  
pki1:  
type: pki  
username\_pattern: CN=(.\*?)(?:,|$)

Thanks,  
Elad

---

<div class="post-metadata">

**Author:** ![eyaldahari](https://avatars.discourse-cdn.com/v4/letter/e/c5a1d2/32.png) [@eyaldahari](https://discuss.elastic.co/u/eyaldahari)\
**Post date:** [July 31, 2016, 5:42pm UTC](https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830/2 "2016-07-31T17:42:44Z")

</div>

I also have encountered the same problem. Couldn't find why I don't see any sign for client authentication using PKI and I have almost the same configuration. I can see three way SSL handshake and all steps of key exchange but not client authentication. Would also love to get some insights about this issue.

---

<div class="post-metadata">

**Author:** ![Elad\_Benedict](https://avatars.discourse-cdn.com/v4/letter/e/b19c9b/32.png) [@Elad\_Benedict](https://discuss.elastic.co/u/Elad_Benedict)\
**Post date:** [August 1, 2016, 6:29am UTC](https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830/3 "2016-08-01T06:29:04Z")

</div>

Mystery solved -  
shield.http.ssl.client.auth: optional

See full documentation here: [https://www.elastic.co/guide/en/shield/2.0/reference.html](https://www.elastic.co/guide/en/shield/2.0/reference.html)

Geez, I'd expect this to be in the PKI tutorial... :S

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/pki-authentication-with-shield-client-certificate-not-requested/56830/4 "2017-07-06T13:42:34Z")

</div>