How to configure Elasticsearch for TLS

Enabling TLS in Elasticsearch encrypts network traffic, securing sensitive information against interception and tampering.

TLS secures both HTTP and transport layers, providing robust authentication of nodes and clients while ensuring confidentiality and integrity of data in transit.

Adopting TLS aligns with best practices and compliance standards, creating a secure environment for reliable analytics, search, and data management operations.

1. Generate or obtain the required TLS certificates and keys.

   Use the built-in Elasticsearch certificate utility or acquire certificates from a trusted CA.

2. Place the certificates and keys in a secure location with proper permissions.
3. Edit elasticsearch.yml to enable TLS for HTTP and transport communication.

   $ sudo nano /etc/elasticsearch/elasticsearch.yml

   Set xpack.security.http.ssl.enabled and xpack.security.transport.ssl.enabled to true.

4. Specify paths to the certificates and keys in the configuration.
5. Restart Elasticsearch to apply changes.

   $ sudo systemctl restart elasticsearch

   Ensure clients trust the CA or certificates used by the cluster.

6. Verify secure connectivity.

   $ curl --request GET --insecure --silent https://localhost:9200 | jq
   {
     "name": "secure-node",
     ...
   }

   HTTPS responses confirm TLS encryption is active.

7. Check certificate validity and expiration regularly.

   Use openssl to inspect certificates and ensure they remain valid.