# XPACK Security in ELK stack 7.1.1 **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [June 3, 2019, 3:14pm UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004 "2019-06-03T15:14:49Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![sunnynazar](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@sunnynazar](https://discuss.elastic.co/u/sunnynazar)\ **Post date:** [June 3, 2019, 3:14pm UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/1 "2019-06-03T15:14:49Z")
Hi Guys, I am working with ELK stack 7.1.1 version on kubernetes using image: [docker.elastic.co/elasticsearch/elasticsearch:7.1.1](http://docker.elastic.co/elasticsearch/elasticsearch:7.1.1) I am facing an issue , when xpack security is enabled on elasticsearch cluster , elasticsearch components fail to start with below error. It says either disable the security or change xpack.security.transport.ssl.enabled to true as i am on basic license. * * * {"type": "server", "timestamp": "2019-06-03T15:00:26,674+0000", "level": "INFO", "component": "o.e.b.BootstrapChecks", "cluster.name": "opselasticsearch", "node.name": "elasticsearch-master-2", "message": "bound or publishing to a non-loopback address, enforcing bootstrap checks" } ERROR: [1] bootstrap checks failed [1]: Transport SSL must be enabled if security is enabled on a [basic] license. Please set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false] * * * why do i need to enable ssl if i am on basic licsense and xpac security enabled is true. please help me to understand this. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 3, 2019, 8:32pm UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/2 "2019-06-03T20:32:51Z")
This is a requirement for _ALL_ licenses that allow ssl (apart from the trial license), not just basic. You need to enable ssl for the transport layer because since you have enabled security, now nodes will start sending data between them that will contain sensitive data such as passwords. If you don't enable SSL, this data is sent between nodes in plaintext ---
**Author:** ![sunnynazar](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@sunnynazar](https://discuss.elastic.co/u/sunnynazar)\ **Post date:** [June 4, 2019, 5:57am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/3 "2019-06-04T05:57:04Z")
So, this means I have to generate certificates also for this ssl to work, because enabling this ssl property alone to true doesn't help as it looks for certificates and gives handshake failure. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 4, 2019, 6:20am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/4 "2019-06-04T06:20:43Z")
Yes, that is exactly what this mean. You must configure SSL between nodes in order to enable security. [https://www.elastic.co/guide/en/elastic-stack-overview/7.1/encrypting-internode-communications.html](https://www.elastic.co/guide/en/elastic-stack-overview/7.1/encrypting-internode-communications.html) ---
**Author:** ![sunnynazar](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@sunnynazar](https://discuss.elastic.co/u/sunnynazar)\ **Post date:** [June 4, 2019, 6:55am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/5 "2019-06-04T06:55:32Z")
Can you please give a guide which tells the steps for containerised elk stack. The link above is just for single node and doesn't include all steps. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 4, 2019, 7:54am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/6 "2019-06-04T07:54:12Z")
[https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls-docker.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls-docker.html) ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [June 4, 2019, 8:20am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/7 "2019-06-04T08:20:53Z")
For a cluster that is running in [production mode](https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html#_development_vs_production_mode) with a production license, once security is enabled, transport TLS/SSL must also be enabled. On the other hand, if we are running with a trial license, then transport TLS/SSL is not obligatory. If we are running with a production license and we attempt to start the cluster with security enabled before we have enabled transport TLS/SSL, we will see the following error message: Transport SSL must be enabled for setups with production licenses. Please set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false] ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 4, 2019, 8:41am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/8 "2019-06-04T08:41:32Z")
Hi @ylasri, this is expected behavior. Is there a question? If so, can you please open a new issue, so that it's clearer for people reading the forums? ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [June 4, 2019, 10:29am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/9 "2019-06-04T10:29:15Z")
Hi @ikakavas I just provided this comment as answer to @sunnynazar issue In my dev env i change `discovery.type` to `single-node` to get thing working quickly ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 4, 2019, 11:03am UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/10 "2019-06-04T11:03:26Z")
> [@ylasri](#): > > Hi @ikakavas I just provided this comment as answer to @sunnynazar issue Gotcha, thank you for the clarification and the feedback ! ---
**Author:** ![sunnynazar](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@sunnynazar](https://discuss.elastic.co/u/sunnynazar)\ **Post date:** [June 6, 2019, 3:42pm UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/11 "2019-06-06T15:42:05Z")
Issue was fixed. thanks @all. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2019, 3:42pm UTC](https://discuss.elastic.co/t/xpack-security-in-elk-stack-7-1-1/184004/12 "2019-07-04T15:42:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.