WARNING: Version 6.2 of the Elastic Stack has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Setting Up TLS on a Cluster
editSetting Up TLS on a Cluster
editX-Pack security enables you to encrypt traffic to, from, and within your Elasticsearch cluster. Connections are secured using Transport Layer Security (TLS), which is commonly referred to as "SSL".
Clusters that do not have encryption enabled send all data in plain text including passwords and will not be able to install a license that enables X-Pack security.
The following steps describe how to enable encryption across the various components of the Elastic Stack. You must perform each of the steps that are applicable to your cluster.
- Generate a private key and X.509 certificate for each of your Elasticsearch nodes. See Generating Node Certificates.
- Configure each node in the cluster to identify itself using its signed certificate and enable TLS on the transport layer. You can also optionally enable TLS on the HTTP layer. See Encrypting Communications Between Nodes in a Cluster and Encrypting HTTP Client Communications.
- Configure X-Pack monitoring to use encrypted connections. See Monitoring and Security.
- Configure Kibana to encrypt communications between the browser and the Kibana server and to connect to Elasticsearch via HTTPS. See Configuring Security in Kibana.
- Configure Logstash to use TLS encryption. See Configuring Security in Logstash.
- Configure Beats to use encrypted connections. See Beats and Security.
- Configure the Java transport client to use encrypted communications. See Java Client and Security.
- Configure Elasticsearch for Apache Hadoop to use secured transport. See Elasticsearch for Apache Hadoop Security.