# searchguard.ssl.transport.keystore\_filepath must be set if transport ssl is reqested Error

**URL:** <https://forum.search-guard.com/t/searchguard-ssl-transport-keystore-filepath-must-be-set-if-transport-ssl-is-reqested-error/430>\
**Category:** Search Guard\
**Created:** [April 9, 2017, 2:53pm UTC](https://forum.search-guard.com/t/searchguard-ssl-transport-keystore-filepath-must-be-set-if-transport-ssl-is-reqested-error/430 "2017-04-09T14:53:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leo\_Selochnik](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@Leo\_Selochnik](https://forum.search-guard.com/u/Leo_Selochnik)\
**Post date:** [April 9, 2017, 2:53pm UTC](https://forum.search-guard.com/t/searchguard-ssl-transport-keystore-filepath-must-be-set-if-transport-ssl-is-reqested-error/430/1 "2017-04-09T14:53:28Z")

</div>

Hello,

I keep getting this error (tried different settings) … just wanted to try a plain vanilla basic authentication w/o ssl

Step 1 - Installed the searchguard plug-in using the following command → bin/elasticsearch-plugin install -b com.floragunn:search-guard-5:5.2.2-11

Step 2 - Tried to start the cluster (version 5.2.2 - one node cluster), but got this error “searchguard.ssl.transport.keystore\_filepath must be set if transport ssl is reqested”  
Based on the support matrix that I found in the seach-guar wiki, ssl support comes bundled for searchguard 5.2.2-11, so I’ve decided to explicitly disable ssl.  
Grabbed these options from the searchguard-ssl-config-template.yml

file and added them to elasticsearch-5.2.2/plugins/search-guard-5/sgconfig/elasticsearch.yml

Step 3 - added the following options to elasticsearch.yml

searchguard.ssl.transport.enabled: false  
searchguard.ssl.http.enabled: false  
searchguard.ssl.transport.enforce\_hostname\_verification: false  
searchguard.ssl.transport.resolve\_hostname: false  
searchguard.ssl.transport.enable\_openssl\_if\_available:false

but still getting the same error… I guess I’m missing something here - definitely need some guidance 🙂

Thanks in advance,  
Leo

---

<div class="post-metadata">

**Author:** ![0x2a1](https://avatars.discourse-cdn.com/v4/letter/0/977dab/32.png) [@0x2a1](https://forum.search-guard.com/u/0x2a1)\
**Post date:** [April 11, 2017, 10:07am UTC](https://forum.search-guard.com/t/searchguard-ssl-transport-keystore-filepath-must-be-set-if-transport-ssl-is-reqested-error/430/2 "2017-04-11T10:07:43Z")

</div>

Hello,

according to the readme ([search-guard/README.md at master · floragunncom/search-guard · GitHub](https://github.com/floragunncom/search-guard/blob/master/README.md)): “Transport SSL is mandatory and you have to generate certificates for the nodes”

searchguard.ssl.transport.\* settings are for the transport API (mainly used for inter-cluster communication, but also for sgadmin)  
searchguard.ssl.http.\* settings are for the REST API (used for applications, e.g. logstash,kibana,…) for which SSL/TLS can be disabled.

see also [https://github.com/floragunncom/search-guard-ssl-docs/blob/master/certificates.md](https://github.com/floragunncom/search-guard-ssl-docs/blob/master/certificates.md)

for non production environments you could either use:

- the search guard bundle ([GitHub - floragunncom/search-guard: Search Guard Plugin - Security for Elasticsearch](https://github.com/floragunncom/search-guard/wiki/Search-Guard-Bundle), preconfigured environment containing elasticsearch and search guard)
- the example-pki-scripts from the search-guard-ssl repository([https://github.com/floragunncom/search-guard-ssl/tree/master/example-pki-scripts](https://github.com/floragunncom/search-guard-ssl/tree/master/example-pki-scripts)), example.sh will generate a root CA, certificates for nodes, and user certificates (can be used for user/admin authentication)
- the floragunn certificate generator [Security and Alerting for Elasticsearch and Kibana | Search Guard](https://floragunn.com/tls-certificate-generator/)

the elasticsearch.yml(.example) file in the sgconfig directory is just an example for the “real” elasticsearch config. (usually in /etc/elasticsearch/elasticsearch.yml)

regards,  
0x2a

> **···**
>
> On Sunday, April 9, 2017 at 4:53:28 PM UTC+2, Leo Selochnik wrote:
> 
> > Hello,
> > 
> > I keep getting this error (tried different settings) … just wanted to try a plain vanilla basic authentication w/o ssl
> > 
> > Step 1 - Installed the searchguard plug-in using the following command → bin/elasticsearch-plugin install -b com.floragunn:search-guard-5:5.2.2-11
> > 
> > Step 2 - Tried to start the cluster (version 5.2.2 - one node cluster), but got this error “searchguard.ssl.transport.keystore\_filepath must be set if transport ssl is reqested”  
> > Based on the support matrix that I found in the seach-guar wiki, ssl support comes bundled for searchguard 5.2.2-11, so I’ve decided to explicitly disable ssl.  
> > Grabbed these options from the searchguard-ssl-config-template.yml
> > 
> > file and added them to elasticsearch-5.2.2/plugins/search-guard-5/sgconfig/elasticsearch.yml
> > 
> > Step 3 - added the following options to elasticsearch.yml
> > 
> > searchguard.ssl.transport.enabled: false  
> > searchguard.ssl.http.enabled: false  
> > searchguard.ssl.transport.enforce\_hostname\_verification: false  
> > searchguard.ssl.transport.resolve\_hostname: false  
> > searchguard.ssl.transport.enable\_openssl\_if\_available:false
> > 
> > but still getting the same error… I guess I’m missing something here - definitely need some guidance 🙂
> > 
> > Thanks in advance,  
> > Leo

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [April 11, 2017, 10:12am UTC](https://forum.search-guard.com/t/searchguard-ssl-transport-keystore-filepath-must-be-set-if-transport-ssl-is-reqested-error/430/3 "2017-04-11T10:12:28Z")

</div>

0x2a is correct, you cannot disable TLS on the transport layer if you want to have authentication/authorisation.

We are in the course of updating the complete docs to make this more clear. In the meantime, you can use the tools mentioned by 0x2a to generate the certs.

As a side note: The next release of Search Guard will include a script to generate and install demo certificates on a vanilla ES installation. Release is planned for next week. Stay tuned!

> **···**
>
> On Sunday, April 9, 2017 at 4:53:28 PM UTC+2, Leo Selochnik wrote:
> 
> > Hello,
> > 
> > I keep getting this error (tried different settings) … just wanted to try a plain vanilla basic authentication w/o ssl
> > 
> > Step 1 - Installed the searchguard plug-in using the following command → bin/elasticsearch-plugin install -b com.floragunn:search-guard-5:5.2.2-11
> > 
> > Step 2 - Tried to start the cluster (version 5.2.2 - one node cluster), but got this error “searchguard.ssl.transport.keystore\_filepath must be set if transport ssl is reqested”  
> > Based on the support matrix that I found in the seach-guar wiki, ssl support comes bundled for searchguard 5.2.2-11, so I’ve decided to explicitly disable ssl.  
> > Grabbed these options from the searchguard-ssl-config-template.yml
> > 
> > file and added them to elasticsearch-5.2.2/plugins/search-guard-5/sgconfig/elasticsearch.yml
> > 
> > Step 3 - added the following options to elasticsearch.yml
> > 
> > searchguard.ssl.transport.enabled: false  
> > searchguard.ssl.http.enabled: false  
> > searchguard.ssl.transport.enforce\_hostname\_verification: false  
> > searchguard.ssl.transport.resolve\_hostname: false  
> > searchguard.ssl.transport.enable\_openssl\_if\_available:false
> > 
> > but still getting the same error… I guess I’m missing something here - definitely need some guidance 🙂
> > 
> > Thanks in advance,  
> > Leo