# Shield and x509 auth for http(s) clients **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 12, 2016, 9:44pm UTC](https://discuss.elastic.co/t/shield-and-x509-auth-for-http-s-clients/44239 "2016-03-12T21:44:57Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![h33x](https://avatars.discourse-cdn.com/v4/letter/h/3e96dc/32.png) [@h33x](https://discuss.elastic.co/u/h33x)\ **Post date:** [March 12, 2016, 9:44pm UTC](https://discuss.elastic.co/t/shield-and-x509-auth-for-http-s-clients/44239/1 "2016-03-12T21:44:57Z")
Hi all! Can anyone help me? I want to secure AWS and our elasticsearch installation with SSL and (for simplest usage) with x509 authentication. What I do: 1 - Set up CA authority by [this article](https://www.elastic.co/guide/en/shield/current/certificate-authority.html) 2 - Import created CA certificate to system java cacerts keystore. 3 - Import CA to trusted keystore (trusted.jks) 4 - Make a client keystore with rsa key (node00 on this example) 5 - Make CSR based on client key 6 - Make the certificate for client with my CA 7 - import CA cert with root alias to client jks (node00.jks) 8 - import client cert to node00.jks 9 - additionally I exported all from node00.jks to PCSK12 file and import to my browser for test authentication. (I understand, that some steps is excess, I does it when I try to get wanted results from system). 10 - I add ssl support to elasticsearch.yml, following Shield documentation: # _cat elasticsearch.yml_: `shield: authc: realms: pki1: type: pki order: 1 esusers1: type: esusers order: 0 ssl: keystore: path: "/etc/elasticsearch/ssl/node00.jks" password: "changeme" key_password: "changeme" truststore: path: "/etc/elasticsearch/ssl/trusted.jks" password: "changeme" hostname_verification: false hostname_verification.resolve_name: false http: ssl: true client: auth: required transport: ssl: true client: auth: optional` # _cat shield/role\_mapping.yml_: `admin: - "cn=node00,ou=test cluster,o=h33x test env" ` Output of OpenSSL for verification: # _openssl x509 -subject -nameopt RFC2253 -noout -in 02.pem_: `subject= CN=node00,OU=test cluster,O=h33x test env,L=Novosibirsk,ST=Siberia,C=RU` Also, in first iteration of tests, block with esusers realms does not exists. But anyway I saw only HTTP basic authentication. HTTPS works great, no errors on log files (exclude messages about missing tokens if press Cancel on Auth request on browser) What I does wrong? PS Sorry for my poor English ☹ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/shield-and-x509-auth-for-http-s-clients/44239/2 "2017-07-06T13:46:09Z")