# Xpack SSL configuartion of organization-specific certificate authority **URL:** \ **Category:** Elasticsearch\ **Created:** [November 1, 2017, 9:21am UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004 "2017-11-01T09:21:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![GabayAvi](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@GabayAvi](https://discuss.elastic.co/u/GabayAvi)\ **Post date:** [November 1, 2017, 9:21am UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/1 "2017-11-01T09:21:48Z")
i created a a CSR flle with certgen --csr send the file to our organization certificate authority got ther cer file but i don't know how to configure it corrent to work in secure mode. which trusted certificated i need to get form owr CA , just root certificate or more... did some configure the ELK with SPECIFIC CA ? thankS Avinoam ---
**Author:** ![forloop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/forloop/32/9021_2.png) [@forloop](https://discuss.elastic.co/u/forloop)\ **Post date:** [November 2, 2017, 5:55am UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/2 "2017-11-02T05:55:58Z")
I've moved your question to the X-Pack category as it relates to X-Pack Security. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 2, 2017, 6:59am UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/3 "2017-11-02T06:59:10Z")
I'm making the following assumptions: 1. You want to configure SSL for transport communication (communication between the cluster's nodes) and for HTTP (the REST interface for clients). 2. You're using a single certificate for your whole cluster (I assume this based on your use of "a CSR file" above) 3. The certificate you received from your CA has a _Subject Alternative Name_ for every hostname in your cluster. Numbers 2 and 3 will also be true if you just have a single node cluster, but in that case you probably don't want to configure SSL for transport communication, and just switch to single node discovery instead. The instructions below will be a little different if those assumptions are not true. You need two do 3 things: 1. Copy your certificate onto your elasticsearch nodes. 2. Configure your nodes to trust your organization's certificate authority. 3. Enable TLS. ### Copy your certificate onto your elasticsearch nodes. You need the `.cer` file from your organization's CA, and you also need the `.key` file that was produced when you ran `certgen`. You need to copy both of those files onto your elasticsearch server, and place them somewhere within your `config` directory. I recommend placing everything in `config/ssl/`, but it doesn't really matter as long as it's somewhere within the config directory. For the sake of this post, I'll assume that you call them `config/ssl/elasticsearch.cer` and `config/ssl/elasticsearch.key`, but you should use whatever names are meaningful for you. ### Configure your nodes to trust your organization's certificate authority. Since you are using an organisation wide CA, there's a few options here. It's possible that your organisation CA is already installed as a trusted CA within your JVM. A lot of organisations run packaging scripts that automatically configure that, but I don't know if that's the case for you. The simplest, more reliable option is to get copy of the CA certificate in _PEM_ format (something named `.cer` or `.crt` or `.cert` is probably going to be a PEM file) and install a copy in your `config/ssl/` directory e.g. as `config/ssl/org-ca.cer` Then, in your `config/elasticsearch.yml` file, you add ``` xpack.security.transport.ssl.certificate_authorities = ["ssl/org-ca.cer"] ``` X-Pack automatically looks within the "config/" directory, so you don't include the "config/" part of your pathname. ### Enable TLS Assuming you used the pathnames I gave above, you'd want to have something like this in your `elasticsearch.yml` (on every node) ```auto xpack.ssl.key: ssl/elasticsearch.key xpack.ssl.certificate: ssl/elasticsearch.cer xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.certificate_authorities = ["ssl/org-ca.cer"] xpack.security.http.ssl.enabled: true ``` Then do a full cluster restart (i.e. shutdown all the nodes in your cluster, and bring them up again). Now, SSL should be enabled and you should be able to connect to the cluster over `https`. If you are using Kibana, then you will need to make some configuration changes there as well. ---
**Author:** ![GabayAvi](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@GabayAvi](https://discuss.elastic.co/u/GabayAvi)\ **Post date:** [November 2, 2017, 3:04pm UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/4 "2017-11-02T15:04:37Z")
Thans alot for your professional answer i'll try it. ---
**Author:** ![GabayAvi](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@GabayAvi](https://discuss.elastic.co/u/GabayAvi)\ **Post date:** [November 7, 2017, 4:35pm UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/5 "2017-11-07T16:35:18Z")
Hi it did'nt work ... this what i put in elasticsearch.yml xpack.ssl.key: /etc/elasticsearchuat/x-pack/disc\_cert/lnxelk01.key xpack.ssl.certificate: /etc/elasticsearchuat/x-pack/disc\_cert/lnxelk01.cer xpack.ssl.certificate\_authorities: ["/etc/elasticsearchuat/x-pack/disc\_cert/HO\_ROOT\_CA.cer" ,"/etc/elasticsearchuat/x-pack/disc\_cert/IntranetIntermidiate.cer"] and this what we got in the log [2017-11-07T15:42:05,302][INFO][o.e.n.Node] [uat\_1] started [2017-11-07T15:42:06,452][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [uat\_1] http client did not trust this server's certificate, closing connection [id: 0x6a7e470a, L:0.0.0.0/0.0.0.0:9500 ! R:/160.66.1.119:54338] [2017-11-07T15:42:07,729][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [uat\_1] caught exception while handling client http traffic, closing connection [id: 0x2b058ca5, L:0.0.0.0/0.0.0.0:9500 ! R:/160.66.1.119:54341] io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 48454144202f20485454502f312e310d0a486f73743a203136 What could be ther problem ?? Thanks Avinoam ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 12, 2017, 11:57pm UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/6 "2017-11-12T23:57:53Z")
> [@GabayAvi](#): > > What could be ther problem ?? The error messages you are receiving are quite explicit: - ``` http client did not trust this server's certificate ``` - ``` not an SSL/TLS record ``` In the first case, whatever HTTP client you are using to connect to ES, isn't configured to trust your certificate. In the second case, the client isn't configured to use https at all. That's a client problem not an Elasticsearch problem. What is the client? How has it been configured? ---
**Author:** ![GabayAvi](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@GabayAvi](https://discuss.elastic.co/u/GabayAvi)\ **Post date:** [November 20, 2017, 1:18pm UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/7 "2017-11-20T13:18:44Z")
Hay i found the solution after open case in elastic supp. owr CA create PFX that was with extended keys of SERVER & CLIENT ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 18, 2017, 1:18pm UTC](https://discuss.elastic.co/t/xpack-ssl-configuartion-of-organization-specific-certificate-authority/106004/8 "2017-12-18T13:18:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.