Secure Elastic connection using transport client

Question

Need to connect to a secure elastic search which has https authentication using Transport client in java code. I have userId and password to connect secure elastic. I am using elasticsearch 7.10.0.

try {
            Settings settings = Settings.builder().put("cluster.name", clusterName)
                    .put("xpack.security.user", "elastic:elastic")      
                    .put("xpack.security.transport.ssl.enabled", "true")
                    .put("xpack.ssl.key", "/etc/elasticsearch/elasticsearch.keystore")
                    .put("xpack.ssl.certificate", "/etc/elasticsearch/elastic-certificates.p12")
                    .put("xpack.ssl.certificate_authorities", "/etc/elasticsearch/elastic-stack-ca.p12")
                    .put("xpack.security.transport.ssl.enabled", "true")
                    .build();
            ESclient = new PreBuiltTransportClient(settings);

            //changes for add multiple IP address
            String[] hosts = elasticHost.split(",");
            for (String host : hosts) {
                ESclient.addTransportAddress(new TransportAddress(InetAddress.getByName(host.trim()), elasticPort));
            }
            System.out.println(ESclient.settings());
        } catch (UnknownHostException ex) {
            System.out.println("Exception :" + ex);
            //logger.error("Exception : " + ex);
            throw ex;
        }

But its showing Error:

java.lang.IllegalArgumentException: unknown setting [xpack.security.transport.ssl.enabled] please check that any required plugins are installed, or check the breaking changes documentation for removed settings

Please let me know,what i am missing in above code.Thanks in advance.

Is there any reason for using the [TCP transport client](https://www.elastic.co/guide/en/elasticsearch/client/java-api/current/transport-client.html) which is deprecated instead of the [REST one](https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/index.html)? — Val, Dec 06 '20 at 10:16
@val: can you provide example code to create secure elastic connection? — Atul Thakre, Dec 07 '20 at 05:18
The [official documentation](https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/_encrypted_communication.html) explains how to do it for the Java REST client — Val, Dec 07 '20 at 06:25
@val : i have used transport client.but its showing "None of the configured nodes are available:". — Atul Thakre, Dec 09 '20 at 11:00
The password to your keystore where the certificate is stored. — Val, Dec 09 '20 at 12:39
@val : RestHighLevelClient client = new RestHighLevelClient(builder); its showing error:Not supported yet.:java.lang.UnsupportedOperationException? let me know the solution. — Atul Thakre, Dec 09 '20 at 13:08
Also you should comment my answer instead of your question ;-) — Val, Dec 09 '20 at 13:09
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/225725/discussion-between-atul-thakre-and-val). — Atul Thakre, Dec 09 '20 at 13:19

Val · Answer 1 · 2020-12-09T12:19:59.720

0

You should not use the TCP transport client anymore since it's been deprecated in 7.0. Instead you should use the REST client which communicates with your cluster over HTTP.

If you need to communicate over HTTPS with your cluster, here is how to do it with the REST client:

// 1. create an SSL context to trust the CA that signed the ES server certificate
String keyStorePass = "keystorePassword";
Path trustStorePath = Paths.get("/etc/elasticsearch/elastic-stack-ca.p12");
KeyStore truststore = KeyStore.getInstance("pkcs12");
try (InputStream is = Files.newInputStream(trustStorePath)) {
    truststore.load(is, keyStorePass.toCharArray());
}
SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, null);
final SSLContext sslContext = sslBuilder.build();

// 2. Basic authentication
final CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials("elastic", "password"));

// 3. Changes for add multiple IP address
String[] hosts = elasticHost.split(",");
HttpHost[] httpHosts = Arrays.stream(hosts)
     .map(host -> new HttpHost(host.trim(), elasticPort, "https"))
     .collect(Collectors.toList())
     .toArray(new HttpHost[hosts.length]);

// 4. Build the low-level client
RestClientBuilder builder = RestClient.builder(httpHosts)
    .setHttpClientConfigCallback(new HttpClientConfigCallback() {
        @Override
        public HttpAsyncClientBuilder customizeHttpClient(
                HttpAsyncClientBuilder httpClientBuilder) {

            // set Basic credentials
            httpClientBuilder.setDefaultCredentialsProvider(credsProvider);
            // set SSL context
            return httpClientBuilder.setSSLContext(sslContext);
        }
    });

// 5. Build the high-level client
RestHighLevelClient client = new RestHighLevelClient(builder);

If you need to migrate your Java code to use the new RETS client, the official documentation provides a step-by-step guide on what needs to be done.

edited Dec 09 '20 at 12:19

answered Dec 07 '20 at 07:34

Val

207,596
13
358
360

I m using ES 7.10.0. – Atul Thakre Dec 09 '20 at 13:45
what is KeyStore truststore = KeyStore.getInstance("pkcs12") ? – Atul Thakre Dec 10 '20 at 10:50
That line is just to create a PKCS#12 keystore in which you will store the certificate to verify the server certificate. – Val Dec 10 '20 at 12:04
Received fatal alert: handshake_failure:javax.net.ssl.SSLHandshakeException ? – Atul Thakre Dec 10 '20 at 12:08
Can you update your question with the full stack trace you get please? – Val Dec 10 '20 at 12:35
see my detail question here : https://stackoverflow.com/questions/65234013/error-received-fatal-alert-handshake-failurejavax-net-ssl-sslhandshakeexcept – Atul Thakre Dec 10 '20 at 12:54
Still I don't see the detailed stack trace for SSLHandshakeException – Val Dec 10 '20 at 12:55
See now i have update detail error in https://stackoverflow.com/questions/65234013/error-received-fatal-alert-handshake-failurejavax-net-ssl-sslhandshakeexcept – Atul Thakre Dec 10 '20 at 13:02
I don't get why you have two questions for the same issue, the other one is at risk of being closed – Val Dec 10 '20 at 13:05
Can you add `-Djavax.net.debug=ssl` to the java command line of your client so we can get more insights? – Val Dec 10 '20 at 13:07
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/225773/discussion-between-atul-thakre-and-val). – Atul Thakre Dec 10 '20 at 13:11

score 0 · Answer 2 · answered Oct 20 '21 at 10:41

Use x-pack-transport jar and PreBuiltXPackTransportClient constructor

Use x-pack-transport jar and PreBuiltXPackTransportClient constructor

            Settings settings = Settings.builder()
                .put("cluster.name", "elasticsearch")
                .put("xpack.security.user", "elastic:elastic")
                .build();
        TransportClient transportClient = new PreBuiltXPackTransportClient(settings);
        transportClient = transportClient.addTransportAddress(new TransportAddress(new InetSocketAddress("127.0.0.1", 9300)));

Secure Elastic connection using transport client

2 Answers2

Linked