# TSL configuration

**URL:** <https://discuss.elastic.co/t/tsl-configuration/288548>\
**Category:** Kibana\
**Tags:** elastic-stack-security, elastic-stack-alerting\
**Created:** [November 6, 2021, 7:57pm UTC](https://discuss.elastic.co/t/tsl-configuration/288548 "2021-11-06T19:57:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SabriMahmoud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sabrimahmoud/32/96652_2.png) [@SabriMahmoud](https://discuss.elastic.co/u/SabriMahmoud)\
**Post date:** [November 6, 2021, 7:57pm UTC](https://discuss.elastic.co/t/tsl-configuration/288548/1 "2021-11-06T19:57:31Z")

</div>

**Note :** My version of Elasticsearch is **7.15.0**

* * *

I'm new to **Elasticsearch** , I'm trying to use **Kibana alerts** , to do that I must create a **Rule and a Connector** but when I've selected that field I've been got informed to **enable Transport Layer Security and API keys** to do so I followed the [Elastic TSL guide instructions](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/security-basic-setup.html#encrypt-internode-communication) where the instructor describe these steps :

> Encrypt internode communications with TLS :
> 
> **1.** Open the **$ES\_PATH\_CONF/elasticsearch.yml** file and make the following **changes** :  
> **a.** Add the **cluster-name** setting and enter a name for your cluster:

```
cluster.name: my-cluster

```

> **b.** Add the **node.name** setting and enter a name for the node. The node name defaults to the host-name of the machine when Elasticsearch starts.

```
node.name: node-1

```

> **c.** Add the following settings to enable inter-node communication and provide access to the node’s certificate.  
> Because you are using the same **elastic-certificates.p12** file on every node in your cluster, set the verification mode to **certificate** :

```
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate 
xpack.security.transport.ssl.client_authentication: required
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

```

Since the elastic-certificates are not generated automatically during the installation of the Software it must be generated by the **elasticsearch-certutil** inside the **/usr/share/elasticsearch/bin directory** :

**a.** First :

```
cd /usr/share/elasticsearch/bin

```

**b.** run the elastic-certutil to generate the **elastic-stack-ca.zip** certificate file :

```
 bin/elasticsearch-certutil ca

```

**c.** unzip the file to exract the all information and move them to the /etc/elasticsearch directory .

```
unzip elastic-stack-ca.zip

```

Now the problem occurs when starting the elasticsearch service :

```
sudo service elasticsearch restart 

```

` Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for details.`

I tried to see where the error is located by running **these two** control commands but I did not understand .

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [November 8, 2021, 7:13am UTC](https://discuss.elastic.co/t/tsl-configuration/288548/2 "2021-11-08T07:13:57Z")

</div>

Your best bet is to have a look at the [Elasticsearch log output](https://www.elastic.co/guide/en/elasticsearch/reference/current/logging.html).  
That should tell you what went wrong.

---

<div class="post-metadata">

**Author:** ![SabriMahmoud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sabrimahmoud/32/96652_2.png) [@SabriMahmoud](https://discuss.elastic.co/u/SabriMahmoud)\
**Post date:** [November 8, 2021, 3:06pm UTC](https://discuss.elastic.co/t/tsl-configuration/288548/4 "2021-11-08T15:06:54Z")

</div>

I did changed the permission of the elastic-certificates.p12  
I have no error now but after restarting Elasticsearch I found the same message :

## **You must enable Transport Layer Security and API keys**

why that configuration didn't work ? it is as like as without it at the first place .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2021, 3:07pm UTC](https://discuss.elastic.co/t/tsl-configuration/288548/5 "2021-12-06T15:07:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.