# SSL termination for Elasticsearch cluster

**URL:** <https://discuss.elastic.co/t/ssl-termination-for-elasticsearch-cluster/325613>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [February 15, 2023, 12:46pm UTC](https://discuss.elastic.co/t/ssl-termination-for-elasticsearch-cluster/325613 "2023-02-15T12:46:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Buddha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buddha/32/101523_2.png) [@Buddha](https://discuss.elastic.co/u/Buddha)\
**Post date:** [February 15, 2023, 12:46pm UTC](https://discuss.elastic.co/t/ssl-termination-for-elasticsearch-cluster/325613/1 "2023-02-15T12:46:24Z")

</div>

Hi, I'm trying to add a HAProxy service within the docker-compose.yml outlined here: ([Install Elasticsearch with Docker | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#_prepare_the_environment)). I was wondering if anyone had done the same and could share their set up?

Alternatively, could someone comment what I'm doing wrong as I get HAProxy working:

```auto
solacom-haproxy-1 | [NOTICE] (1) : haproxy version is 2.7.2-7e295dd
solacom-haproxy-1 | [NOTICE] (1) : path to executable is /usr/local/sbin/haproxy
solacom-haproxy-1 | [WARNING] (1) : config : log format ignored for proxy 'stats' since it has no log address.
solacom-haproxy-1 | [WARNING] (1) : config : log format ignored for frontend 'elasticsearch_frontend' since it has no log address.
solacom-haproxy-1 | [WARNING] (1) : config : log format ignored for frontend 'kibana_frontend' since it has no log address.
solacom-haproxy-1 | [NOTICE] (1) : New worker (8) forked
solacom-haproxy-1 | [NOTICE] (1) : Loading success.

```

But, when I navigate to [https://localhost:9200](https://localhost:9200), I get an error:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/d/9d9d4471d66f8118b593a74b45db353c245cd245.png)

docker-compose.yml snippet:

```auto
  haproxy:
    restart: unless-stopped
    depends_on:
      es01:
        condition: service_healthy
      es02:
        condition: service_healthy
      es03:
        condition: service_healthy
      kibana:
        condition: service_healthy
    image: haproxy:${HAPROXY_VERSION}
    volumes:
      - certs:/usr/share/haproxy/config/certs
      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg
    ports:
      - ${HAPROXY_PORT}:${HAPROXY_PORT} 
      - ${KIBANA_PORT}:${KIBANA_PORT}
      - ${ES_PORT}:${ES_PORT}   
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -u admin:admin http://localhost:1936",
        ]
      interval: 30s
      timeout: 10s
      retries: 5

```

haproxy.cfg

```auto
global
  maxconn 4096
  # log /var/lib/haproxy/dev/log local0
  user haproxy
  group haproxy

defaults
  log global
  mode http
  option httplog 
  retries 3
  option dontlognull
  maxconn 2000
  timeout connect 10s
  timeout client 30s
  timeout server 30s

listen stats
  bind *:1936
  mode http
  stats auth admin:admin  
  stats enable
  stats hide-version
  stats realm Haproxy\ Statistics
  stats uri /

frontend elasticsearch_frontend
  description "elasticsearch"
  bind *:443 ssl crt /usr/share/haproxy/config/certs/es01/es01.pem
  http-request redirect scheme https unless { ssl_fc }
  default_backend elasticsearch_backend

frontend kibana_frontend
  description "kibana"
  mode http
  bind 0.0.0.0:5601
  default_backend kibana_backend

backend elasticsearch_backend
  balance roundrobin
  server es01 es01:9200 check fall 3 rise 2 

backend kibana_backend
  option httpchk GET /
  balance roundrobin
  server kibana kibana:5601 check fall 3 rise 2

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 15, 2023, 10:14pm UTC](https://discuss.elastic.co/t/ssl-termination-for-elasticsearch-cluster/325613/2 "2023-02-15T22:14:46Z")

</div>

Why are you trying to access `https://localhost:9200` ?

Your HAProxy configuration has a frontend for elasticsearch binding on the port `443`, this frontend has one elasticsearch server on the backend.

Your HAProxy is not listening on port `9200` and if you are terminating the SSL on HAProxy, your elasticsearch server is listening on HTTP, not HTTPS.

Can you try to access `https://localhost` ?

---

<div class="post-metadata">

**Author:** ![Buddha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buddha/32/101523_2.png) [@Buddha](https://discuss.elastic.co/u/Buddha)\
**Post date:** [February 17, 2023, 3:21pm UTC](https://discuss.elastic.co/t/ssl-termination-for-elasticsearch-cluster/325613/3 "2023-02-17T15:21:12Z")

</div>

Hello @leandrojmp ,

Thanks for point out that mistake, when I navigate to [https://localhost](https://localhost), I get the same issue:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/5/05d41b7e374014f64e34b5d640dfc47e9226b610.png)

Mike

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2023, 3:21pm UTC](https://discuss.elastic.co/t/ssl-termination-for-elasticsearch-cluster/325613/4 "2023-03-17T15:21:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.