--- title: "Configure each service" description: "Add TLS settings to aerospike.conf, aerospike-elasticsearch-outbound.yml, and elasticsearch.yml." --- # Configure each service > For the complete documentation index see: [llms.txt](https://aerospike.com/docs/llms.txt) > > All documentation pages available in markdown. The [get-started tutorial](https://aerospike.com/docs/connectors/elasticsearch/learn/get-started) connected the authorization service’s write path in Aerospike to the support-search path in Elasticsearch over plain HTTP. This section adds the certificates and credentials each service needs to keep that same path encrypted, from the write in Aerospike to a support agent’s search in Elasticsearch. 1. Create `aerospike.conf` in the project directory. The file adds a `network.tls` configuration for the `asd.aerospike.com` identity, then enables mTLS on the `esDC` Cross-Datacenter Replication (XDR) configuration. aerospike.conf ```text service { cluster-name elasticsearch-demo feature-key-file /etc/aerospike/features.conf } logging { console { context any info } } network { tls asd.aerospike.com { cert-file /etc/aerospike/security/asd.aerospike.com.crt key-file /etc/aerospike/security/asd.aerospike.com.key ca-file /etc/aerospike/security/ca.crt } service { address any port 3000 } heartbeat { mode mesh port 3002 address any interval 150 timeout 10 } fabric { port 3001 address any } info { port 3003 address any } } namespace test { replication-factor 1 storage-engine memory { data-size 1G } nsup-period 10 } xdr { dc esDC { connector true tls-name asd.aerospike.com node-address-port aerospike-elasticsearch-outbound 8443 connector.aerospike.com namespace test { } } } ``` The `network.tls` configuration gives XDR the Aerospike client certificate, private key, and trusted CA. In `esDC`, `tls-name` selects that TLS context, and the TLS name definition after the port in `node-address-port` identifies the Elasticsearch connector as `connector.aerospike.com`. See [Secure XDR with TLS](https://aerospike.com/docs/database/manage/xdr/security#securing-with-tls) for the complete XDR TLS options. 2. Create `aerospike-elasticsearch-outbound.yml` in the project directory. The file adds a `service.tls` configuration for the incoming XDR connection and a `tls-config` under `es-client` for the outgoing Elasticsearch connection. aerospike-elasticsearch-outbound.yml ```yaml service: tls: port: 8443 mutual-auth: true allowed-peer-names: - asd.aerospike.com key-store: store-type: PEM store-file: /etc/aerospike-elasticsearch-outbound/security/connector.aerospike.com.key certificate-chain-files: /etc/aerospike-elasticsearch-outbound/security/connector.aerospike.com.crt trust-store: store-type: PEM certificate-files: /etc/aerospike-elasticsearch-outbound/security/ca.crt manage: address: 0.0.0.0 port: 8902 logging: enable-console-logging: true routing: mode: static destination: aerospike doc-id: source: digest format: mode: custom batch-formatter-class: com.aerospike.connect.elasticsearch.outbound.formatter.ElasticsearchDefaultBatchFormatter payload-format: mode: flat-json metadata-key: metadata es-client: cluster-config: type: on-prem nodes: - host: hostname: elasticsearch port: 9200 scheme: https auth-config: type: basic username: elastic password-file: /etc/aerospike-elasticsearch-outbound/security/elastic-password.txt tls-config: trust-store: store-type: PEM certificate-files: /etc/aerospike-elasticsearch-outbound/security/ca.crt ``` The `service.tls` settings require a certificate issued by the local CA with the peer name `asd.aerospike.com`. The Elasticsearch connector presents its own certificate from `key-store`. Under `es-client`, the Elasticsearch connector uses HTTPS, reads the `elastic` password from a file, and trusts Elasticsearch certificates issued by the local CA. For more options in this section, see [Connector settings](https://aerospike.com/docs/connectors/elasticsearch/configure/service) and [Elasticsearch client](https://aerospike.com/docs/connectors/elasticsearch/configure/es-client). 3. Create `elasticsearch.yml` to enable authentication and serve HTTPS on port `9200`. elasticsearch.yml ```yaml cluster.name: aerospike-demo node.name: elasticsearch network.host: 0.0.0.0 discovery.type: single-node xpack.security.enabled: true xpack.security.http.ssl.enabled: true xpack.security.http.ssl.key: certs/elasticsearch.local.key xpack.security.http.ssl.certificate: certs/elasticsearch.local.crt ``` The security setting activates the built-in `elastic` user and requires authentication. The HTTP SSL settings serve the Elasticsearch certificate over HTTPS. Transport-layer TLS between Elasticsearch nodes is not enabled in this single-node tutorial. 4. Create `security/elastic-password.txt` with a dev-only password for the `elastic` user. The Elasticsearch connector reads this value when it authenticates to Elasticsearch. The built-in `elastic` superuser is appropriate only for this local tutorial. For longer-lived environments, use a dedicated account or API key with only the permissions the Elasticsearch connector requires. Terminal ```bash echo -n "changeme-for-dev" > security/elastic-password.txt chmod 0640 security/elastic-password.txt ``` ## Checkpoint Before you compose the stack, your project directory contains these configuration and security files: - Directoryaerospike-elastic-tls/ - .env - aerospike-elasticsearch-outbound.yml - aerospike.conf - elasticsearch.yml - features.conf - Directorysecurity/ - asd.aerospike.com.crt - asd.aerospike.com.key - ca.crt - connector.aerospike.com.crt - connector.aerospike.com.key - elastic-password.txt - elasticsearch.local.crt - elasticsearch.local.key ::: undefined - I’ve configured XDR to use mTLS. - I’ve configured the Elasticsearch connector to accept mTLS and connect to Elasticsearch over HTTPS. - I’ve enabled HTTPS and authentication in Elasticsearch. ::: [Previous Generate certificates](https://aerospike.com/docs/connectors/elasticsearch/learn/secure-with-tls/step/1/part/1/generate-certificates) [Next Compose the stack](https://aerospike.com/docs/connectors/elasticsearch/learn/secure-with-tls/step/2/part/1/compose-stack)