2018-02-15 14:41:01 -05:00
|
|
|
|
[role="xpack"]
|
|
|
|
|
|
[[tls-transport]]
|
|
|
|
|
|
==== Encrypting Communications Between Nodes in a Cluster
|
|
|
|
|
|
|
|
|
|
|
|
The transport networking layer is used for internal communication between nodes
|
|
|
|
|
|
in a cluster. When {security} is enabled, you must use TLS to ensure that
|
|
|
|
|
|
communication between the nodes is encrypted.
|
|
|
|
|
|
|
|
|
|
|
|
. <<node-certificates,Generate node certificates>>.
|
|
|
|
|
|
|
|
|
|
|
|
. Enable TLS and specify the information required to access the node’s
|
|
|
|
|
|
certificate.
|
|
|
|
|
|
|
|
|
|
|
|
** If the signed certificate is in PKCS#12 format, add the following information to the
|
|
|
|
|
|
`elasticsearch.yml` file on each node:
|
|
|
|
|
|
+
|
|
|
|
|
|
--
|
|
|
|
|
|
[source,yaml]
|
|
|
|
|
|
-----------------------------------------------------------
|
|
|
|
|
|
xpack.security.transport.ssl.enabled: true
|
|
|
|
|
|
xpack.security.transport.ssl.verification_mode: certificate <1>
|
|
|
|
|
|
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 <2>
|
|
|
|
|
|
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12 <3>
|
|
|
|
|
|
-----------------------------------------------------------
|
|
|
|
|
|
<1> If you used the `--dns` or `--ip` options with the `certutil cert` command
|
|
|
|
|
|
and you want to enable strict hostname checking, set the verification mode to
|
|
|
|
|
|
`full`.
|
2018-04-10 06:27:23 -04:00
|
|
|
|
See <<ssl-tls-settings, `xpack.ssl.verification_mode`>> for a description of these values.
|
|
|
|
|
|
|
2018-02-15 14:41:01 -05:00
|
|
|
|
<2> If you created a separate certificate for each node, then you might need to
|
|
|
|
|
|
customize this path on each node. If the filename matches the node name, you can
|
|
|
|
|
|
use the `certs/${node.name}.p12` format, for example.
|
|
|
|
|
|
<3> The `certutil` output includes the CA certificate inside the PKCS#12
|
|
|
|
|
|
keystore, therefore the keystore can also be used as the truststore. This name
|
|
|
|
|
|
should match the `keystore.path` value.
|
|
|
|
|
|
--
|
|
|
|
|
|
|
|
|
|
|
|
** If the certificate is in PEM format, add the following information to the
|
|
|
|
|
|
`elasticsearch.yml` file on each node:
|
|
|
|
|
|
+
|
|
|
|
|
|
--
|
|
|
|
|
|
[source, yaml]
|
|
|
|
|
|
--------------------------------------------------
|
|
|
|
|
|
xpack.security.transport.ssl.enabled: true
|
|
|
|
|
|
xpack.security.transport.ssl.verification_mode: certificate <1>
|
|
|
|
|
|
xpack.security.transport.ssl.key: /home/es/config/x-pack/node01.key <2>
|
|
|
|
|
|
xpack.security.transport.ssl.certificate: /home/es/config/x-pack/node01.crt <3>
|
|
|
|
|
|
xpack.security.transport.ssl.certificate_authorities: [ "/home/es/config/x-pack/ca.crt" ] <4>
|
|
|
|
|
|
--------------------------------------------------
|
|
|
|
|
|
<1> If you used the `--dns` or `--ip` options with the `certutil cert` command
|
|
|
|
|
|
and you want to enable strict hostname checking, set the verification mode to
|
|
|
|
|
|
`full`.
|
2018-04-10 06:27:23 -04:00
|
|
|
|
See <<ssl-tls-settings, `xpack.ssl.verification_mode`>> for a description of these values.
|
2018-02-15 14:41:01 -05:00
|
|
|
|
<2> The full path to the node key file. This must be a location within the
|
|
|
|
|
|
{es} configuration directory.
|
|
|
|
|
|
<3> The full path to the node certificate. This must be a location within the
|
|
|
|
|
|
{es} configuration directory.
|
|
|
|
|
|
<4> An array of paths to the CA certificates that should be trusted. These paths
|
|
|
|
|
|
must be a location within the {es} configuration directory.
|
|
|
|
|
|
--
|
|
|
|
|
|
|
|
|
|
|
|
. If you secured the node's certificate with a password, add the password to
|
|
|
|
|
|
your {es} keystore:
|
|
|
|
|
|
|
|
|
|
|
|
** If the signed certificate is in PKCS#12 format, use the following commands:
|
|
|
|
|
|
+
|
|
|
|
|
|
--
|
|
|
|
|
|
[source,shell]
|
|
|
|
|
|
-----------------------------------------------------------
|
|
|
|
|
|
bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
|
|
|
|
|
|
|
|
|
|
|
|
bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
|
|
|
|
|
|
-----------------------------------------------------------
|
|
|
|
|
|
--
|
|
|
|
|
|
|
|
|
|
|
|
** If the certificate is in PEM format, use the following commands:
|
|
|
|
|
|
+
|
|
|
|
|
|
--
|
|
|
|
|
|
[source,shell]
|
|
|
|
|
|
-----------------------------------------------------------
|
|
|
|
|
|
bin/elasticsearch-keystore add xpack.security.transport.ssl.secure_key_passphrase
|
|
|
|
|
|
-----------------------------------------------------------
|
|
|
|
|
|
--
|
|
|
|
|
|
|
|
|
|
|
|
. Restart {es}.
|
|
|
|
|
|
+
|
|
|
|
|
|
--
|
|
|
|
|
|
You must perform a full cluster restart. Nodes which are configured to use TLS
|
|
|
|
|
|
cannot communicate with nodes that are using unencrypted networking (and
|
|
|
|
|
|
vice-versa). After enabling TLS you must restart all nodes in order to maintain
|
|
|
|
|
|
communication across the cluster.
|
|
|
|
|
|
--
|
|
|
|
|
|
|
|
|
|
|
|
NOTE: All TLS-related node settings are considered to be highly sensitive and
|
|
|
|
|
|
therefore are not exposed via the
|
|
|
|
|
|
{ref}/cluster-nodes-info.html#cluster-nodes-info[nodes info API] For more
|
|
|
|
|
|
information about any of these settings, see <<security-settings>>.
|
