# Where are Keystore and Truststore: How can Spark communicate with ECK by using SSL
**URL:** https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029
**Category:** Elastic Cloud on Kubernetes (ECK)
**Created:** [March 10, 2020, 10:33pm UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029 "2020-03-10T22:33:33Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@YaSe](https://discuss.elastic.co/u/YaSe)
#### Post date: [March 10, 2020, 10:33pm UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029/1 "2020-03-10T22:33:33Z")
Hello,
I followed this link to install [ECK](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html#k8s-deploy-eck) and now I want to use Spark with ECK by using SSL. I read the following [documentation](https://www.elastic.co/guide/en/elasticsearch/hadoop/current/configuration.html#_ssl). However for the following configuration I don't know where to find the keystore and truststore files.
- es.net.ssl.keystore.type
- es.net.ssl.truststore.location
- es.net.ssl.truststore.pass
Can someone explain where to find them ?
Thanks
---
### Author:  [@michael.morello](https://discuss.elastic.co/u/michael.morello)
#### Post date: [March 11, 2020, 8:00am UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029/2 "2020-03-11T08:00:44Z")
Hi,
You have to create the keystore. Assuming you are using the default, self signed, certificates with ECK you can find more information about how to get CA cert here: [https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html#k8s-request-elasticsearch-endpoint](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html#k8s-request-elasticsearch-endpoint)
You can then create a keystore, mount it as a secret if Spark is deployed in K8S and set the correct values for Elasticsearch for Hadoop.
---
### Author:  [@YaSe](https://discuss.elastic.co/u/YaSe)
#### Post date: [March 11, 2020, 4:40pm UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029/3 "2020-03-11T16:40:59Z")
> [@michael.morello](#):
>
> self signed, certificates
Hi @michael.morello, thanks for your reply !
Can you recommend documentation to create the keystore from CA ? I found ones but it didn't work ☹ .
Futhermore, do I need to create a truststore as well if i use the self-signed certificate ?
Regards
---
### Author:  [@michael.morello](https://discuss.elastic.co/u/michael.morello)
#### Post date: [March 11, 2020, 5:18pm UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029/4 "2020-03-11T17:18:42Z")
Sorry, I think you should actually add the CA to a `truststore`, not a `keystore`
Also note that it will only work if you access Elasticsearch from the k8s cluster since the certificates, by default, only contains some predefined subjects like:
- `cluster-name`
- `cluster-name.cluster-namespace`
- `cluster-name.cluster-namespace.svc`
See [here](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html#k8s-static-ip-custom-domain) if you want to add your own subjects.
re. the way to create a keystore I think that something like `keytool -import -alias ca -file /path/to/ca.crt -keystore cacerts -storepass changethispassword` should work
---
### Author:  [@YaSe](https://discuss.elastic.co/u/YaSe)
#### Post date: [March 14, 2020, 12:38pm UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029/5 "2020-03-14T12:38:40Z")
Thanks @michael.morello, I achieved to generate the truststore.jks file and it can be read by my spark job. However, I got an error "Invalid keystore format". I will open a new topic about this error.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 7:48am UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029/6 "2022-11-04T07:48:44Z")