# Spring Data ElasticSearch with SSL

**URL:** <https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, language-clients\
**Created:** [December 18, 2022, 6:26pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499 "2022-12-18T18:26:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Schneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_schneider/32/77408_2.png) [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\
**Post date:** [December 18, 2022, 6:26pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499/1 "2022-12-18T18:26:29Z")

</div>

Hi,

I'm trying to understand how basic SSL works using Spring Data Elasticsearch.  
In order to use SSL for Secure HTTPS configuration you need to call _**usingSsl()**_ method without any parameter during creation of RestHighLevelClient client:  
_ClientConfiguration.MaybeSecureClientConfigurationBuilder builder = ClientConfiguration.builder()**.usingSsl()**_

For common code example please refer to:

> **[Spring Data ElasticSearch with Basic Auth](https://www.javacodemonk.com/spring-data-elasticsearch-https-and-basic-auth-ed8ba04d)**
>
> In this article we will configure Spring Data Elastic Search RestHighLevelClient using SSL and Basic Authentication.

My question is how the client knows which trust store it should use for server certificate. Is it a property that should be provided in some configuration file? If yes, what is a name of the property and where it should be defined?

Thank you in advance  
Daniel

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [December 19, 2022, 3:07am UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499/2 "2022-12-19T03:07:27Z")

</div>

This is more of a question for the spring data team than elasticsearch. That said, the Builder class has a overloaded `usingSsl` method that takes a `SSLContext` parameter.

> <https://github.com/spring-projects/spring-data-elasticsearch/blob/2ea568d2e41f0fc971de2714136884fc31347b24/src/main/java/org/springframework/data/elasticsearch/client/ClientConfigurationBuilder.java#L117>

---

<div class="post-metadata">

**Author:** ![Daniel\_Schneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_schneider/32/77408_2.png) [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\
**Post date:** [December 19, 2022, 9:31am UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499/3 "2022-12-19T09:31:13Z")

</div>

Thank you. Yes, indeed, there is an overloaded method, but I would like to know how Elasticsearch server trust store is defined without parameters.

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [December 19, 2022, 10:46pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499/4 "2022-12-19T22:46:14Z")

</div>

> [@Daniel\_Schneider](#):
>
> how Elasticsearch _server_ trust store is defined without parameters

The spring data code configures the client, not the server. Assuming your question is about how "client" truststore is configured without parameter. A reasonable guess would be it will use the JDK's default truststore (`cacerts`).

---

<div class="post-metadata">

**Author:** ![Daniel\_Schneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_schneider/32/77408_2.png) [@Daniel\_Schneider](https://discuss.elastic.co/u/Daniel_Schneider)\
**Post date:** [December 19, 2022, 10:59pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499/5 "2022-12-19T22:59:41Z")

</div>

Yes, it seems so. Spring Data should use default Elasticsearch certificate generated by publicly trusted CA installed on client's machine. Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2023, 11:00pm UTC](https://discuss.elastic.co/t/spring-data-elasticsearch-with-ssl/321499/6 "2023-01-16T23:00:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.