# Several question about SSL/TLS **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 8, 2019, 8:23am UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069 "2019-11-08T08:23:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![laijianbin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laijianbin/32/50512_2.png) [@laijianbin](https://discuss.elastic.co/u/laijianbin)\ **Post date:** [November 8, 2019, 8:23am UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069/1 "2019-11-08T08:23:29Z")
Hi, I am reference [security](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls.html#tls-http) configured SSL/TLS in elasticsearch My elasticsearch.yml: > xpack.security.enabled: true > network.host: MY\_IP > xpack.security.transport.ssl.enabled: true > xpack.security.transport.ssl.verification\_mode: certificate > xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 > xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12 > xpack.security.http.ssl.enabled: true > xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12 > xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12 when `curl -k -u elastic:123456 -X GET https://MY_IP:9200`,there is nothing wrong. My question: ``` 1. How can I get the same result without "-k" 2. How to connect with elasticsearch in java ``` Hope for answer,Thanks! ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [November 8, 2019, 3:36pm UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069/2 "2019-11-08T15:36:31Z")
Hey, in order to not use `curl -k` you would need to make sure that curl knows the cacert you used to create the Elasticsearch certificates. Regarding your second question and java. The client connecting to elasticsearch also needs to know about the CA you used to sign the certificates. See [https://www.elastic.co/guide/en/elasticsearch/client/java-rest/7.4/\_encrypted\_communication.html](https://www.elastic.co/guide/en/elasticsearch/client/java-rest/7.4/_encrypted_communication.html) --Alex ---
**Author:** ![laijianbin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laijianbin/32/50512_2.png) [@laijianbin](https://discuss.elastic.co/u/laijianbin)\ **Post date:** [November 11, 2019, 7:22am UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069/3 "2019-11-11T07:22:59Z")
@spinscale ,Thank you for your replay. but really I don't know is how can I generate CA,or the CA means elastic-stack-ca.p12? can you please show me a sample or some blogs. thanks again. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [November 11, 2019, 10:12am UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069/4 "2019-11-11T10:12:19Z")
I assume that somehow you generated those certificates? Or did you get that from a third party? Regardless you have to add those to the programs you execute in order to prevent those warning messages (be it curl or the java client). Did you follow the documentation or how were those created? ---
**Author:** ![laijianbin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laijianbin/32/50512_2.png) [@laijianbin](https://discuss.elastic.co/u/laijianbin)\ **Post date:** [November 12, 2019, 1:42am UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069/5 "2019-11-12T01:42:28Z")
@spinscale Thank you for your replay. Firstly , I use x-pack complete basic auth. Secondly，I execute ` bin/elasticsearch-certutil ca` then `elastic-stack-ca.p12` was generated with no password protected. Thirdly, I execute `bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12` then `elastic-certificates.p12` was generated with no password protected. Fourthly, I move `elastic-stack-ca.p12` and `elastic-certificates.p12` to config/certs and restart. At last, I execute`curl -k -u elastic:123456 -X GET https://MY_IP:9200` , and Elasticsearch show me a json. My elasticsearch.yml was configured as mentioned above. So, at this case, **how can I generate certificates** and connect with elasticsearch in java sorry that I have so many question and waste your time Hope for your answer,thank you again. ---
**Author:** ![laijianbin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laijianbin/32/50512_2.png) [@laijianbin](https://discuss.elastic.co/u/laijianbin)\ **Post date:** [November 12, 2019, 2:51am UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069/6 "2019-11-12T02:51:49Z")
@spinscale I am very happy to tell that I have resolved this problem. The "CA" you have mentioned" is `elastic-certificates.p12` that I already generated. My java client is as below. hope this can help someone who need. ``` public static boolean auth(String index) throws Exception { CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials("elastic", "123456")); KeyStore truststore = KeyStore.getInstance("jks"); try (InputStream is = new FileInputStream("./src/main/resources/elastic-certificates.p12")) { truststore.load(is, "123456".toCharArray()); } SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, null); final SSLContext sslContext = sslBuilder.build(); RestClientBuilder builder = RestClient.builder(new HttpHost("MY_IP", 9200, "https")) .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() { @Override public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpClientBuilder) { return httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider) .setSSLContext(sslContext).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE); } }); client = new RestHighLevelClient(builder); GetIndexRequest req = new GetIndexRequest(index); return client.indices().exists(req, RequestOptions.DEFAULT); } ``` my elasticsearch.yml is as below: xpack.security.enabled: true network.host: MY\_IP xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12 xpack.security.transport.ssl.keystore.password: 123456 xpack.security.transport.ssl.truststore.password: 123456 xpack.security.http.ssl.keystore.password: 123456 xpack.security.http.ssl.truststore.password: 123456 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 10, 2019, 2:51am UTC](https://discuss.elastic.co/t/several-question-about-ssl-tls/207069/7 "2019-12-10T02:51:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.