# Missing documentation for Client Certificate Validation **URL:** \ **Category:** Search Guard\ **Created:** [February 26, 2017, 3:28am UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400 "2017-02-26T03:28:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Abhinay\_Thurlapati](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Abhinay\_Thurlapati](https://forum.search-guard.com/u/Abhinay_Thurlapati)\ **Post date:** [February 26, 2017, 3:28am UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400/1 "2017-02-26T03:28:04Z")
Hi, I would like to validate the requests via client certificate. Following the [documentation](https://github.com/floragunncom/search-guard-docs/blob/master/configuration.md), I understood that I need to specify the “http\_authenticator.type” as “clientcert”. There it is mentioned to click on [TLS Client Certification](https://github.com/floragunncom/search-guard-docs/blob/master/httpbasic.md) for further details. However I could see, it is redirecting to [HTTP Basic Authentication](https://github.com/floragunncom/search-guard-docs/blob/master/httpbasic.md) page. Please provide the configuration details I need to follow in order to validate the client certificates. Thanks Abhinay. ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [February 26, 2017, 10:43am UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400/2 "2017-02-26T10:43:58Z")
see [https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg\_config.yml](https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg_config.yml) clientcert\_auth\_domain: enabled: true order: 2 http\_authenticator:   type: clientcert   config:   username\_attribute: cn #optional, if omitted DN becomes username   challenge: false authentication\_backend:   type: noop (order matters if you like to combine it with other authenticators) > **···** > > > Am 26.02.2017 um 04:28 schrieb Abhinay Thurlapati \: > > > > Hi, > > I would like to validate the requests via client certificate. Following the documentation, I understood that I need to specify the "http\_authenticator.type" as "clientcert". There it is mentioned to click on TLS Client Certification for further details. However I could see, it is redirecting to HTTP Basic Authentication page. > > > > Please provide the configuration details I need to follow in order to validate the client certificates. > > > > Thanks > > Abhinay. > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/4d226de6-b524-42cd-95bb-fbb85238a2ee%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/4d226de6-b524-42cd-95bb-fbb85238a2ee%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Abhinay\_Thurlapati](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Abhinay\_Thurlapati](https://forum.search-guard.com/u/Abhinay_Thurlapati)\ **Post date:** [February 26, 2017, 3:28pm UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400/3 "2017-02-26T15:28:45Z")
Thanks for the early response. I followed this approach. I am trying to connect to elastic search using python requests module. I am sending clients signed certificate and the corresponding key generated using example scripts provided by the elastic search. However, iam receiving the response “Authentication finally failed”. Going through the source code, I think it’s not matching with any of authentication mechanism. How do I fix this issue. Also I would like define roles for the client certificate. In that case, in internal users yaml file, what could be the password of the hash. Thanks Abhinay > **···** > > On 26-Feb-2017 4:13 PM, “SG” [info@search-guard.com](mailto:info@search-guard.com) wrote: > > > see [https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg\_config.yml](https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg_config.yml) > > > > clientcert\_auth\_domain: > > > > enabled: true > > > > order: 2 > > > > http\_authenticator: > > > > type: clientcert > > > > config: > > > > ``` > > username_attribute: cn #optional, if omitted DN becomes username > > > > ``` > > > > challenge: false > > > > authentication\_backend: > > > > type: noop > > > > (order matters if you like to combine it with other authenticators) > > > > > Am 26.02.2017 um 04:28 schrieb Abhinay Thurlapati [abhinaythurlapati@gmail.com](mailto:abhinaythurlapati@gmail.com): > > > > > > > > > > Hi, > > > > > I would like to validate the requests via client certificate. Following the documentation, I understood that I need to specify the “http\_authenticator.type” as “clientcert”. There it is mentioned to click on TLS Client Certification for further details. However I could see, it is redirecting to HTTP Basic Authentication page. > > > > > > > > > > Please provide the configuration details I need to follow in order to validate the client certificates. > > > > > > > > > > Thanks > > > > > Abhinay. > > > > > > > > > > – > > > > > You received this message because you are subscribed to the Google Groups “Search Guard” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/4d226de6-b524-42cd-95bb-fbb85238a2ee%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/4d226de6-b524-42cd-95bb-fbb85238a2ee%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/DCA5DF08-365B-4C41-92A3-A0EBB1AFA068%40search-guard.com](https://groups.google.com/d/msgid/search-guard/DCA5DF08-365B-4C41-92A3-A0EBB1AFA068%40search-guard.com). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Me\_He](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Me\_He](https://forum.search-guard.com/u/Me_He)\ **Post date:** [March 2, 2017, 2:38pm UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400/4 "2017-03-02T14:38:22Z")
Hi Abhinay, I ran into the same problem. Not sure if my findings will help you since I am struggling at an other point right now. When trying to setup es with searchguard all from scratch without using bundle and example scripts, I stumbled over something interesting in elasticsearch.yml.example # This is optional # Only needed when impersonation is used # Allow DNs (distinguished names) to impersonate as other users #searchguard.authcz.impersonation\_dn: “CN=spock,OU=client,O=client,L=Test,C=DE”: # - worf # “cn=webuser,ou=IT,ou=IT,dc=company,dc=com”: # - user2 # - user1 # Auditlog configuration: `` On first glance I was no able to find any lines like the above in the yml files provided with the bundles I used. best, Meike > **···** > > On Sunday, February 26, 2017 at 4:28:04 AM UTC+1, Abhinay Thurlapati wrote: > > > Hi, > > I would like to validate the requests via client certificate. Following the [documentation](https://github.com/floragunncom/search-guard-docs/blob/master/configuration.md), I understood that I need to specify the “http\_authenticator.type” as “clientcert”. There it is mentioned to click on [TLS Client Certification](https://github.com/floragunncom/search-guard-docs/blob/master/httpbasic.md) for further details. However I could see, it is redirecting to [HTTP Basic Authentication](https://github.com/floragunncom/search-guard-docs/blob/master/httpbasic.md) page. > > > > > > Please provide the configuration details I need to follow in order to validate the client certificates. > > > > > > Thanks > > > Abhinay. ---
**Author:** ![Me\_He](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Me\_He](https://forum.search-guard.com/u/Me_He)\ **Post date:** [March 2, 2017, 2:43pm UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400/5 "2017-03-02T14:43:19Z")
ah… impersonation is something else… but it seems searchguard is not able to validate the certificates ---
**Author:** ![Abhinay\_Thurlapati](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Abhinay\_Thurlapati](https://forum.search-guard.com/u/Abhinay_Thurlapati)\ **Post date:** [March 2, 2017, 3:02pm UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400/6 "2017-03-02T15:02:54Z")
Forgot to add one point. This search guard is behind apache. Could it be the case that Apache is not forwarding client certificate to search guard. Thanks Abhinay > **···** > > On 02-Mar-2017 8:13 PM, “Me He” [google-work@kampfschnuffel.de](mailto:google-work@kampfschnuffel.de) wrote: > > > ah… impersonation is something else… > > > > but it seems searchguard is not able to validate the certificates > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/7d1a8edc-eae2-487a-8265-d24c0ee4fb56%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/7d1a8edc-eae2-487a-8265-d24c0ee4fb56%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Me\_He](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Me\_He](https://forum.search-guard.com/u/Me_He)\ **Post date:** [March 6, 2017, 12:24pm UTC](https://forum.search-guard.com/t/missing-documentation-for-client-certificate-validation/400/7 "2017-03-06T12:24:32Z")
Hi, if it is behind apache the client certificate may not be forwarded that is true. I have no idea how to check/fix that. I got mine test instance with the bundle finally working. I tried the wrong certificate as it seems, or did not copy truststore.jks properly around. best, Meike > **···** > > On Thursday, March 2, 2017 at 4:02:56 PM UTC+1, Abhinay Thurlapati wrote: > > > Forgot to add one point. This search guard is behind apache. Could it be the case that Apache is not forwarding client certificate to search guard. > > > Thanks > > > Abhinay > > > > ah… impersonation is something else… > > > > > > but it seems searchguard is not able to validate the certificates > > > > – > > > > > > You received this message because you are subscribed to the Google Groups “Search Guard” group. > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/7d1a8edc-eae2-487a-8265-d24c0ee4fb56%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/7d1a8edc-eae2-487a-8265-d24c0ee4fb56%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > On 02-Mar-2017 8:13 PM, “Me He” [googl...@kampfschnuffel.de](mailto:googl...@kampfschnuffel.de) wrote: