# Ssl between nodes

**URL:** <https://discuss.elastic.co/t/ssl-between-nodes/346742>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 8, 2023, 7:51pm UTC](https://discuss.elastic.co/t/ssl-between-nodes/346742 "2023-11-08T19:51:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![My\_Self](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_self/32/127362_2.png) [@My\_Self](https://discuss.elastic.co/u/My_Self)\
**Post date:** [November 8, 2023, 7:51pm UTC](https://discuss.elastic.co/t/ssl-between-nodes/346742/1 "2023-11-08T19:51:38Z")

</div>

hi

I'm upgrading to 8.5.1 in a kubernetes solution with helm installation

And had an issue with ssl between nodes  
Found [The truststore does not contain any trusted certificate entries after upgrade to 8.0](https://discuss.elastic.co/t/the-truststore-does-not-contain-any-trusted-certificate-entries-after-upgrade-to-8-0/298338)

and used solution number 2.

The relevant part of my values.yaml file

```auto
esConfig:
  elasticsearch.yml: |
    xpack.license.self_generated.type: basic
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate 
    xpack.security.transport.ssl.client_authentication: required
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
keystore:
  - secretName: elastic-certificates-password

```

Everything went fine, all the pods started.

But any of them goes to ready state. In logs it's just stuck after  
"message":"successfully loaded geoip database file [GeoLite2-City.mmdb]"

Everything looks ok, so I went inside the pod and curl'ed to check the health endpoint:  
`curl -u elastic:$ELASTIC_PASSWORD -X GET https://localhost:9200/_cluster/health?wait_for_status=green`

It hangs (not always, dont know why) and after a return keypress:  
`curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number`

So, I haven't mounted the elastic-stack-ca.p12 in the pods. In documentation I've understood that it was not needed.

Can you help me?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![My\_Self](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_self/32/127362_2.png) [@My\_Self](https://discuss.elastic.co/u/My_Self)\
**Post date:** [November 15, 2023, 8:26am UTC](https://discuss.elastic.co/t/ssl-between-nodes/346742/2 "2023-11-15T08:26:46Z")

</div>

So....

Changing protocol to http in values.yaml, solves the problem.  
Looking in helm chart, protocol is only used to calculate probe protocol.

In Elastic 7.x.x, http was default.

Does anyone has any idea why was this changed? Is it okay to override this value, or is a better way to solve this?

---

<div class="post-metadata">

**Author:** ![HadesC](https://avatars.discourse-cdn.com/v4/letter/h/49beb7/32.png) [@HadesC](https://discuss.elastic.co/u/HadesC)\
**Post date:** [November 16, 2023, 4:04pm UTC](https://discuss.elastic.co/t/ssl-between-nodes/346742/3 "2023-11-16T16:04:50Z")

</div>

You are enabled transport SSL which is for SSL communication between nodes, if you want to verify if it is working, you should curl the transport port, which by default should be 9300.  
Please notice you have to curl it with CA cert, Private Cert and Private key, then it would return:

> This is not HTTP port

If you want to connect ES API (9200) with HTTPS, you should enable and config

> xpack.security.http.ssl

Hades

---

<div class="post-metadata">

**Author:** ![My\_Self](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/my_self/32/127362_2.png) [@My\_Self](https://discuss.elastic.co/u/My_Self)\
**Post date:** [November 17, 2023, 11:09am UTC](https://discuss.elastic.co/t/ssl-between-nodes/346742/4 "2023-11-17T11:09:37Z")

</div>

Hi,  
thanks for the response.

I was just to post that also.

Had the same issue with kibana, and I had solve this enabling what you've just sugested.

So, the relevant part of values.yaml:

```auto
protocol: https

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12

keystore:
  - secretName: elastic-certificates-password

```

and this secret, elastic-certificates-password need the following keys:

```auto
  "xpack.security.http.ssl.keystore.secure_password",
  "xpack.security.http.ssl.truststore.secure_password",
  "xpack.security.transport.ssl.keystore.secure_password",
  "xpack.security.transport.ssl.truststore.secure_password"

```

```auto
k create secret generic elastic-certificates-password --from-literal=xpack.security.transport.ssl.keystore.secure_password=<the password> --from-literal=xpack.security.transport.ssl.truststore.secure_password=<the password> --from-literal=xpack.security.http.ssl.keystore.secure_password=<the password> --from-literal=xpack.security.http.ssl.truststore.secure_password=<the password>

```

thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2023, 11:10am UTC](https://discuss.elastic.co/t/ssl-between-nodes/346742/5 "2023-12-15T11:10:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.