# Xpack transport client issue ES 5.6.3

**URL:** <https://discuss.elastic.co/t/xpack-transport-client-issue-es-5-6-3/139683>\
**Category:** Elasticsearch\
**Created:** [July 12, 2018, 6:56am UTC](https://discuss.elastic.co/t/xpack-transport-client-issue-es-5-6-3/139683 "2018-07-12T06:56:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rah](https://avatars.discourse-cdn.com/v4/letter/r/4af34b/32.png) [@Rah](https://discuss.elastic.co/u/Rah)\
**Post date:** [July 12, 2018, 6:56am UTC](https://discuss.elastic.co/t/xpack-transport-client-issue-es-5-6-3/139683/1 "2018-07-12T06:56:35Z")

</div>

Hi,

I am trying to enable SSL on two node elasticsearch setup with single xpack transport client.  
I generated cert based on below entries in instances.yaml  
instances:

- name: "node1"  
ip:
  - "192.168.11.115"  
dns:
  - "[node1.abc.com](http://node1.abc.com)"

- name: "node2"  
ip:
  - "192.168.11.217"  
dns:
  - "[node2.abc.com](http://node2.abc.com)"

With this and the properties in elasticsearch.yml, I am able to bring my elastic search server up on both the nodes. But in my client how do I say it to connect to both the nodes. I am building the settings as below for my PreBuiltXPackTransportClient.

```
     builder.put("xpack.security.user", "elastic:changeme")
                     .put("xpack.security.transport.ssl.enabled","true")
                     .put("xpack.ssl.key", "<path to node1 key>")
                     .put("xpack.ssl.certificate", "<path to node1 path>")
                     .put("xpack.ssl.certificate_authorities","<path to ca cert>")
Settings settings = builder.build();
transportClient = new PreBuiltXPackTransportClient(settings);
....TransportAddress address = new InetSocketTransportAddress(....);
transportClient.addTransportAddress(address);

```

As my client takes just one xpack.ssl.key and certificate, how would my client know about the other node running because at a time I can only specify on node key and cert. Based on the documentation, I see ca certificate(xpack.ssl.certificate\_authorities) can be array.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 12, 2018, 7:50am UTC](https://discuss.elastic.co/t/xpack-transport-client-issue-es-5-6-3/139683/2 "2018-07-12T07:50:45Z")

</div>

> [@Rah](#):
>
> As my client takes just one xpack.ssl.key and certificate, how would my client know about the other node running because at a time I can only specify on node key and cert.

You don't.  
The `key` and `certificate` you provide to the transport client are there to identify your client. You should use a unique certificate and key per client, signed by the same CA that signed the node's certificates.

Essentially, each participant (node or transport client) should have their own certificate and associated private key.

---

<div class="post-metadata">

**Author:** ![Rah](https://avatars.discourse-cdn.com/v4/letter/r/4af34b/32.png) [@Rah](https://discuss.elastic.co/u/Rah)\
**Post date:** [July 13, 2018, 6:51pm UTC](https://discuss.elastic.co/t/xpack-transport-client-issue-es-5-6-3/139683/3 "2018-07-13T18:51:40Z")

</div>

Thanks. It worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2018, 6:51pm UTC](https://discuss.elastic.co/t/xpack-transport-client-issue-es-5-6-3/139683/4 "2018-08-10T18:51:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.