# Using Xpack Transport client for multiple nodes with certificate/key **URL:** \ **Category:** Elasticsearch\ **Created:** [September 24, 2018, 2:33pm UTC](https://discuss.elastic.co/t/using-xpack-transport-client-for-multiple-nodes-with-certificate-key/149692 "2018-09-24T14:33:08Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![lengoyvaerts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lengoyvaerts/32/6748_2.png) [@lengoyvaerts](https://discuss.elastic.co/u/lengoyvaerts)\ **Post date:** [September 24, 2018, 2:33pm UTC](https://discuss.elastic.co/t/using-xpack-transport-client-for-multiple-nodes-with-certificate-key/149692/1 "2018-09-24T14:33:08Z")
I have 3 Elasticsearch nodes each configured with X-Pack including keys and certificates for https connections. The certificates and keys are different per node, the certificate authority (ca.crt) is the same. How can I set up a security transport client using Java? I can add a connection for each node on the client but I can only provide one settings object. Since I have 3 keys/certificates, which one should I pass to the settings object? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [September 25, 2018, 12:14am UTC](https://discuss.elastic.co/t/using-xpack-transport-client-for-multiple-nodes-with-certificate-key/149692/2 "2018-09-25T00:14:12Z")
The SSL key (and cert) you provide in TransportClient is a key for the client, not a key for the nodes. The SSL key is private information, you should be protecting it quite tightly, and never pass it out to clients. For Transport Client you have 2 options: - generate a new cert+key pair for each client (using the same CA as your cluster uses). - run a separate "client" transport profile and turn off client certificates on that profile: [https://www.elastic.co/guide/en/elasticsearch/reference/6.4/separating-node-client-traffic.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/separating-node-client-traffic.html) ---
**Author:** ![lengoyvaerts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lengoyvaerts/32/6748_2.png) [@lengoyvaerts](https://discuss.elastic.co/u/lengoyvaerts)\ **Post date:** [September 27, 2018, 10:06pm UTC](https://discuss.elastic.co/t/using-xpack-transport-client-for-multiple-nodes-with-certificate-key/149692/3 "2018-09-27T22:06:34Z")
Thanks for the reply. Could you please explain how to create a cert+key pair for the client using a ca? Is it also through the X-Pack certgen tool? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [September 28, 2018, 6:25am UTC](https://discuss.elastic.co/t/using-xpack-transport-client-for-multiple-nodes-with-certificate-key/149692/4 "2018-09-28T06:25:40Z")
Hi, > [@lengoyvaerts](#): > > Could you please explain how to create a cert+key pair for the client using a ca You can use `elasticsearch-certutil` for this, it's documentation is available [here](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/certutil.html) . See specifically the [cert mode](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/certutil.html#certutil-cert) That said, you can use any other tooling that you want also ( i.e. `openssl` ) if it's more convenient for you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 26, 2018, 6:25am UTC](https://discuss.elastic.co/t/using-xpack-transport-client-for-multiple-nodes-with-certificate-key/149692/5 "2018-10-26T06:25:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.