# Securing ES node to node transport **URL:** \ **Category:** Elasticsearch\ **Created:** [April 7, 2016, 1:10pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683 "2016-04-07T13:10:12Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\ **Post date:** [April 7, 2016, 1:10pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/1 "2016-04-07T13:10:13Z")
Hi, I couldn't find any post or doc that would answer this question. Without using shield, are there any working methods to secure the node-to-node transport of data between ES nodes. Is there a way to enable ssl node-to-node transport? thanks, Michael ---
**Author:** ![tinle](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@tinle](https://discuss.elastic.co/u/tinle)\ **Post date:** [April 7, 2016, 4:53pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/2 "2016-04-07T16:53:04Z")
If you are using a recent version of ES (2.2.x or newer), you could look at [search-guard-ssl](https://github.com/floragunncom/search-guard-ssl). TIn ---
**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\ **Post date:** [April 8, 2016, 3:18pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/3 "2016-04-08T15:18:24Z")
thanks will take look at that. Will have to see if we can make use of the external plugin. May have to get this thru management for approval. Was looking at stunnel to tunnel node-node transport. Does anyone have a working stunnel configuration for ES node transport that can be shared. ---
**Author:** ![tinle](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@tinle](https://discuss.elastic.co/u/tinle)\ **Post date:** [April 8, 2016, 3:53pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/4 "2016-04-08T15:53:36Z")
It's very easy to get SG-SSL working. We have it running across 4 data centers and close to 300 nodes. Eventually we will roll it out to all of our of clusters. It's open source, so if you are concerned about it, you can compile it yourself. Tin ---
**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\ **Post date:** [April 8, 2016, 4:04pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/5 "2016-04-08T16:04:34Z")
you have it working for the latest 2.3.1 es? I didn't see it on their matrix as too how supported it was. Its not about open source, every piece of software that is used in production here has to be vetted by security/administrative group if its not in rhel/epel. Every version change of a piece of software needs to be revetted. I'll have to submit the plugin for review and continue without it in the mean time. ---
**Author:** ![tinle](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@tinle](https://discuss.elastic.co/u/tinle)\ **Post date:** [April 8, 2016, 5:12pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/6 "2016-04-08T17:12:41Z")
I just tested upgrading one of my cluster to ES v2.3.1 and SG-SSL 2.3.1.8 and yes, it works fine. I will do more testing and schedule upgrade of the rest of my current clusters that is running ES + SG-SSL once I am satisfied that there is no regression. Yes, I understand the need for security review. We've already gotten approval by our security to use SG-SSL. I am sure you'll need to go through yours. Tin ---
**Author:** ![mnhan](https://avatars.discourse-cdn.com/v4/letter/m/8baadc/32.png) [@mnhan](https://discuss.elastic.co/u/mnhan)\ **Post date:** [April 11, 2016, 4:01pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/7 "2016-04-11T16:01:26Z")
My ES boxes has no internet access so everything will need to be transfer to them via scp. Being new to adding plugins to ES, do i simply compile the source with maven and then point the plugin application at the target dir it makes? I assume I will have cmpile this on a box with internet access to get things compiled and transfer everything as a tarball to the ES host. Trying to get a handle on what to do while waiting for approval. Thanks for the help. Michael ---
**Author:** ![tinle](https://avatars.discourse-cdn.com/v4/letter/t/c77e96/32.png) [@tinle](https://discuss.elastic.co/u/tinle)\ **Post date:** [April 11, 2016, 11:07pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/8 "2016-04-11T23:07:49Z")
If you want to build the jar file yourself, then yes, you will need to do it on a box that has internet access. Just clone the git repo from github, then run > mvn package That should pull everything you need and build the packages. Tin ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:00pm UTC](https://discuss.elastic.co/t/securing-es-node-to-node-transport/46683/9 "2017-07-05T23:00:31Z")