# SSL enabling the elasticsearch node library?

**URL:** <https://discuss.elastic.co/t/ssl-enabling-the-elasticsearch-node-library/17604>\
**Category:** Elasticsearch\
**Created:** [May 19, 2014, 9:31pm UTC](https://discuss.elastic.co/t/ssl-enabling-the-elasticsearch-node-library/17604 "2014-05-19T21:31:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sean\_Pines](https://avatars.discourse-cdn.com/v4/letter/s/f6c823/32.png) [@Sean\_Pines](https://discuss.elastic.co/u/Sean_Pines)\
**Post date:** [May 19, 2014, 9:31pm UTC](https://discuss.elastic.co/t/ssl-enabling-the-elasticsearch-node-library/17604/1 "2014-05-19T21:31:10Z")

</div>

Hi all,

New user to ElasticSearch and it's been absolutely amazing in a dev  
environment so far. However one strong requirement that we have is to  
ensure the cluster is secured s.t. it can only be accessed via client  
certificates (SSL/TLS).

Our setup is essentially four machines, three of which are running Elastic  
Search and the fourth is running an SSL enabled proxy (so I can close off  
HTTP/TCP to the outside world on the ES nodes). This setup works  
wonderfully; marvel works with no modifications and sense only requires  
that I specify the full URL (GET [https://111.111.111.111:1111/type/\_search](https://111.111.111.111:1111/type/_search))  
and I can send curl commands all day.

However, when using the ElasticsearchJS library (located  
at [https://github.com/elasticsearch/elasticsearch-js](https://github.com/elasticsearch/elasticsearch-js)), I cannot find a  
clean way to connect to the SSL proxy.

Editing http.js as follows will do the trick:

HttpConnector.prototype.makeReqParams = function (params) {  
.........  
var reqParams = {  
method: params.method || 'GET',  
protocol: host.protocol + ':',  
auth: host.auth,  
hostname: host.host,  
port: host.port,  
path: (host.path || '') + (params.path || ''),  
headers: host.getHeaders(params.headers),  
agent: this.agent  
};

// Inject https/ssl options into the agent (clean way to do this?)  
if (host.pfx){  
reqParams.agent.options.pfx = host.pfx;  
reqParams.agent.options.rejectUnauthorized = host.rejectUnauthorized;  
}  
..........  
}

Which I'd then seed with the following:  
var client = new elasticsearch.Client({  
host: {  
protocol: 'https',  
host: '111.111.111.111',  
port: '1111',  
pfx: fs.readFileSync('certs/dummyCert.p12'),  
rejectUnauthorized: false  
}  
});

I would highly prefer to not have to edit the core library code though. Is  
there a way to specify your agent / agent options from the Client  
constructor (or a better way of going about this in general)?  
makeAgentConfig seems to only let you customize your min/max sockets.

Thanks!  
Sean

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6db70d31-2b00-4242-bee2-41c25268a816%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6db70d31-2b00-4242-bee2-41c25268a816%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:28am UTC](https://discuss.elastic.co/t/ssl-enabling-the-elasticsearch-node-library/17604/2 "2017-07-06T01:28:21Z")

</div>