# Xpack without SSL/Certificates **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [February 19, 2021, 12:37am UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773 "2021-02-19T00:37:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![madduck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madduck/32/63444_2.png) [@madduck](https://discuss.elastic.co/u/madduck)\ **Post date:** [February 19, 2021, 12:37am UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773/1 "2021-02-19T00:37:18Z")
Hi gang, with upgrading our environments to 7.11 I tackled an old issue of mine: Trying to get our dev. cluster running with the xpack features active but without the need for those pesky certificates all the time. The requirement for the setting `xpack.security.enabled` to ALWAYS have `xpack.security.transport.ssl.enabled` set to true as well is kind of annoying. I am very well aware that this would result in my "secure" cluster sending data over the network in plaintext, freely accessible by any attacker. Please let me deal with this risk myself. Not every elasticsearch cluster is a prod. cluster. We have developer environments, all of our developers work with the SIEM application, a lot of them use their own device as a log source, as well as any OS/Appllication they might have an interest in. With the current way elasticsearch is handling this it is extremely diffcult for us to work with the SIEM application and just add a new log source to the mix. Every single time a developer wants to onboard a new log source he will have to create certificates for it. I have not found a way to run `xpack.security.enabled: true` without the need for certificates. If there is some sort of developement setting I am not aware of, please let me now.. Kind Regards, madduck ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 19, 2021, 2:18am UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773/2 "2021-02-19T02:18:48Z")
There's no way to do this, enabling Security is TLS at a min. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 19, 2021, 3:51am UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773/3 "2021-02-19T03:51:41Z")
> [@madduck](#): > > Every single time a developer wants to onboard a new log source he will have to create certificates for it. I don't follow. `xpack.security.transport.ssl.enabled` is the setting that enabled SSL on "transport" protocol, which is how ES nodes communicate with one another. Turning on SSL between your Elasticsearch nodes should have zero impact on configuring new log sources. ---
**Author:** ![madduck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madduck/32/63444_2.png) [@madduck](https://discuss.elastic.co/u/madduck)\ **Post date:** [February 19, 2021, 12:13pm UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773/4 "2021-02-19T12:13:17Z")
> Turning on SSL between your Elasticsearch nodes should have zero impact on configuring new log sources. When I said "configuring log sources" I might have used a wrong term. This is about setting up a new client and getting data through beats into the evironment. It is to my understanding that with that setting enabled all elasticsearch components are in need of certificates in order to communicate with each other. So when developer A decides to do some work on a Linux machine and sets it up, he now has to create certificates for his new machine etc. I just wanted to know if there is a way to work with the SIEM application and not be forced into the whole certificate ordeal because we keep getting complaints that its not "easy" enough. > [@Xpack without SSL/Certificates](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773/2): > > There's no way to do this, enabling Security is TLS at a min. Thank you, this is what I thought but its good to have an official statement 🙂 ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [February 19, 2021, 12:51pm UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773/5 "2021-02-19T12:51:48Z")
I think there is quite some confusion here. It's certainly required to enable security on the _transport_ protocol, that's what `xpack.security.transport.ssl.enabled` does and what Mark meant, but that has no bearing on SIEM's interaction with Elasticsearch because SIEM is a collection of HTTP clients, it doesn't use the transport protocol. The transport protocol is only used between nodes. The security configuration for HTTP clients is quite separate from the transport protocol config and comprises mostly the settings matching `xpack.security.http.ssl.*` . It probably helps to read [these docs](https://www.elastic.co/guide/en/elasticsearch/reference/7.12/modules-network.html) which describe the distinction, and [these docs](https://www.elastic.co/guide/en/elasticsearch/reference/7.12/security-settings.html#http-tls-ssl-settings) cover the security configuration for HTTP clients. > [@madduck](#): > > Every single time a developer wants to onboard a new log source he will have to create certificates for it. If `xpack.security.http.ssl.client_authentication` is `none` (the default) then clients (i.e. log sources) don't need their own certificate. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 19, 2021, 12:52pm UTC](https://discuss.elastic.co/t/xpack-without-ssl-certificates/264773/6 "2021-03-19T12:52:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.