Skip to content

Start and verify

For the complete documentation index see: llms.txt

All documentation pages available in markdown.

Before you write a dispute record, confirm every tier of the pipeline is running with TLS in place. Support agents cannot search cases that never left Aerospike, encrypted or not.

  1. Start every service in the background.

    Terminal
    docker compose up -d

  2. Wait until every container reports healthy or running.

    Terminal
    Terminal
    docker compose ps --format 'table {{.Name}}\t{{.Status}}'
    Container status
    Expected output
    NAME                               STATUS
    aerospike                          Up 14 seconds (healthy)
    aerospike-elasticsearch-outbound   Up 10 seconds
    aerospike-tools                    Up 12 seconds
    elasticsearch                      Up 14 seconds (healthy)

    Elasticsearch may take a little longer to report healthy while the security stack initializes on first boot. If a container exits or does not become available, see Troubleshoot.

  3. Inspect the Elasticsearch connector’s TLS listener.

    Terminal
    Terminal
    openssl x509 \
      -in ./security/connector.aerospike.com.crt \
      -noout -issuer -ext subjectAltName
    

    openssl s_client -brief \
      -CAfile ./security/ca.crt \
      -cert ./security/asd.aerospike.com.crt \
      -key ./security/asd.aerospike.com.key \
      -verify_hostname connector.aerospike.com \
      -verify_return_error \
      -servername connector.aerospike.com \
      -connect localhost:8443 </dev/null
    Certificate and mTLS handshake
    Expected output
    issuer=... mkcert development CA ...
    X509v3 Subject Alternative Name:
        DNS:connector.aerospike.com, ...
    CONNECTION ESTABLISHED
    Verification: OK
    ...

    The exact issuer text varies by machine. The SAN must include DNS:connector.aerospike.com, and the handshake must report Verification: OK. Supplying the Aerospike client certificate and key also verifies that the listener accepts the configured mTLS identity.

  4. Verify the listener rejects a client that does not present a certificate.

    Terminal
    Terminal
    if openssl s_client -brief \
      -CAfile ./security/ca.crt \
      -verify_hostname connector.aerospike.com \
      -verify_return_error \
      -servername connector.aerospike.com \
      -connect localhost:8443 </dev/null >/dev/null 2>&1; then
      echo 'Unexpected: connection succeeded without a client certificate' >&2
      false
    else
      echo 'Client certificate required'
    fi
    Client authentication result
    Expected output
    Client certificate required

  5. Verify the Elasticsearch connector management endpoint is available on the loopback interface.

    Terminal
    curl -fsS 'http://localhost:8902/manage/rest/v1/metrics' > /dev/null

    The command exits without output when the endpoint responds successfully.