---
title: "Tutorial: Secure the Elasticsearch Connector with TLS"
description: "Configure mutual TLS between Aerospike Database and the Elasticsearch connector, and server TLS between the connector and Elasticsearch, using Docker Compose."
---

# Tutorial: Secure the Elasticsearch Connector with TLS

> For the complete documentation index see: [llms.txt](https://aerospike.com/docs/llms.txt)
> 
> All documentation pages available in markdown.

::: note
Developers and operators who want to secure an Aerospike-to-Elasticsearch pipeline with TLS.
:::
::: undefined
This tutorial should take between 20 and 30 minutes.
:::

## Objectives

By the end of this tutorial, you will be able to:

-   Configure mutual TLS between Aerospike XDR and the Elasticsearch connector using mkcert certificates.
-   Enable server TLS and basic authentication between the Elasticsearch connector and Elasticsearch.
-   Write a record in Aerospike Database and verify it reaches Elasticsearch over HTTPS.
-   Run a support desk’s Elasticsearch search over HTTPS for a specific merchant’s open disputes.

## Introduction

The [Get started with the Elasticsearch Connector](https://aerospike.com/docs/connectors/elasticsearch/learn/get-started) tutorial runs a complete dispute-search pipeline, but two network hops are unprotected.

1.  **Aerospike Database to the Elasticsearch connector.** Cross-Datacenter Replication (XDR) change notification delivers each dispute record to the connector over unencrypted HTTP on port `8080`. Dispute records carry merchant names, amounts, and memos. This payment data must not travel in plain text on a production network.
2.  **The Elasticsearch connector to Elasticsearch.** The connector indexes those records over unencrypted HTTP, and Elasticsearch accepts support searches without TLS or authentication. Anyone who can reach port `9200` could read indexed dispute data or run queries against it.

In production, you encrypt and authenticate both hops. Mutual TLS (mTLS) on the XDR connection proves Aerospike and the connector are who they claim to be and keeps the change feed confidential. Server TLS plus basic authentication on the Elasticsearch connection protect indexed data in transit and restrict who can search it.

In this tutorial, you add both layers to the local Docker Compose stack from the “Get started” tutorial. You write a dispute record to Aerospike Database and run the support agent’s Elasticsearch search over HTTPS to verify each hop is encrypted.

If you completed the previous tutorial in `aerospike-elastic-quickstart`, run `docker compose down` before you start this tutorial. You can reuse its `features.conf` file, but create the separate `aerospike-elastic-tls` project directory used in this tutorial. Both tutorials use the same Docker container names (`aerospike`, `elasticsearch`, `aerospike-elasticsearch-outbound`, `aerospike-tools`).

## What you build

Two TLS layers protect the pipeline:

-   Mutual TLS (mTLS) between Aerospike Database and the Elasticsearch connector. Aerospike presents a client certificate, the Elasticsearch connector presents a server certificate, and each side verifies the other against a shared certificate authority (CA).
-   Server TLS between the Elasticsearch connector and Elasticsearch. Elasticsearch presents a server certificate, and the Elasticsearch connector verifies it against the same CA. The Elasticsearch connector also authenticates to Elasticsearch with the built-in `elastic` user.

TLS data flow

```text
write record

aql client  ─────────────────▶  Aerospike Database          (asd.aerospike.com)

                                         │

                                         │ mTLS XDR

                                         ▼

                                Elasticsearch connector     (connector.aerospike.com)

                                         │

                                         │ HTTPS + basic auth

                                         ▼

                                    Elasticsearch           (elasticsearch.local)
```

The `aql client` label represents Aerospike Quick Look (AQL) running in the `aerospike-tools` container to simulate application writes. The names in parentheses are certificate identities in the generated subject alternative names (SANs), not public hostnames:

-   `asd.aerospike.com` identifies the Aerospike client certificate.
-   `connector.aerospike.com` identifies the Elasticsearch connector’s mTLS listener.
-   `elasticsearch.local` identifies the Elasticsearch HTTPS endpoint.

Docker Compose connects to services using `aerospike-elasticsearch-outbound` and `elasticsearch`, which are also included in the corresponding certificates.

::: undefined
-   I understand the two TLS layers in the Aerospike-to-Elasticsearch pipeline.
:::

[Next  
Prerequisites](https://aerospike.com/docs/connectors/elasticsearch/learn/secure-with-tls/step/0/part/1/prerequisites)