# PKI security realm lisence **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 19, 2021, 11:01am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392 "2021-05-19T11:01:34Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Armen\_Petrosyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armen_petrosyan/32/80330_2.png) [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Post date:** [May 19, 2021, 11:01am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/1 "2021-05-19T11:01:34Z")
In subscription page [Subscriptions | Elastic Stack Products & Support | Elastic](https://www.elastic.co/subscriptions) Stated that Encrypted communications is under basic subscription. However when I defined pki real for client authentication, it didn't work until I enabled trial version. Looked again on page and found Custom authentication & authorization realms is under platinum subscription. My question is Whether encrypted communication includes two way (mutual) authentication or not? And how I can understand that, based on which doc? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 19, 2021, 11:37am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/2 "2021-05-19T11:37:40Z")
PKI realm is Gold+ license (look for `LDAP, PKI, Active Directory authentication` on the subscription page. If all you need is two way SSL, i.e. mutual TLS or mTLS, you don't need PKI realm. mTLS is available with basic. There are quite a few other posts that are for this topic, e.g.: - [Mutual tls/ssl on elasticsearch](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/197768) - [Mutual tls/ssl on elasticsearch](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/252502) And the relevant settings are: - [Security settings in Elasticsearch | Elasticsearch Guide [7.x] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.x/security-settings.html#http-tls-ssl-settings) ---
**Author:** ![Armen\_Petrosyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armen_petrosyan/32/80330_2.png) [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Post date:** [May 19, 2021, 11:52am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/3 "2021-05-19T11:52:16Z")
Ok, let me elaborate more. I want to work with ES without providing username and password (native realm). I want my external clients to connect to ES and mutually authenticated. Moreover, user that is part of CN on the certificate should have special roles assign to it. Maybe there are two things - authentication and authorization. Authentication indeed covered by mTLS which is under basic license however authorization (association of roles to specific user defined in CN) requires pki realm. This is what suggested by the ikakavas on page you mentioned ([Mutual tls/ssl on elasticsearch - #3 by SukeshGupta](https://discuss.elastic.co/t/mutual-tls-ssl-on-elasticsearch/197768/3)) Is my understanding correct? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 19, 2021, 11:56am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/4 "2021-05-19T11:56:47Z")
> [@Armen\_Petrosyan](#): > > Moreover, user that is part of CN on the certificate should have special roles assign to it. Yes this bit will require PKI realm. ---
**Author:** ![Armen\_Petrosyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armen_petrosyan/32/80330_2.png) [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Post date:** [May 19, 2021, 12:09pm UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/5 "2021-05-19T12:09:51Z")
And this part need Platinum subscription ??? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 19, 2021, 12:23pm UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/6 "2021-05-19T12:23:14Z")
> [@Armen\_Petrosyan](#): > > And this part need Platinum subscription ??? No. It's Gold subscription. ![Screen Shot 2021-05-19 at 10.22.13 pm](https://us1.discourse-cdn.com/elastic/original/3X/5/3/539f02d7296fd365a97c1632d9004b9f2c6657c5.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 20, 2021, 1:41am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/7 "2021-05-20T01:41:42Z")
FWIW you get Platinum level features on our Elasticsearch Service. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [May 20, 2021, 10:55am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/8 "2021-05-20T10:55:19Z")
> [@warkolm](#): > > FWIW you get Platinum level features on our Elasticsearch Service. Unfortunately PKI is not currently available on Elastic Cloud. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 21, 2021, 6:17am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/9 "2021-05-21T06:17:18Z")
Ahh damn. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 18, 2021, 6:17am UTC](https://discuss.elastic.co/t/pki-security-realm-lisence/273392/10 "2021-06-18T06:17:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.