---
title: "Start and verify"
description: "Start the TLS-enabled stack and confirm the Elasticsearch connector mTLS listener accepts Aerospike client certificates."
---

# Start and verify

> For the complete documentation index see: [llms.txt](https://aerospike.com/docs/llms.txt)
> 
> All documentation pages available in markdown.

Before you write a dispute record, confirm every tier of the pipeline is running with TLS in place. Support agents cannot search cases that never left Aerospike, encrypted or not.

1.  Start every service in the background.
    
    Terminal
    
    ```bash
    docker compose up -d
    ```
    
2.  Wait until every container reports `healthy` or `running`.
    
    Terminal
    
    Terminal
    
    ```bash
    docker compose ps --format 'table {{.Name}}\t{{.Status}}'
    ```
    
    Container status
    
    Expected output
    
    ```text
    NAME                               STATUS
    
    aerospike                          Up 14 seconds (healthy)
    
    aerospike-elasticsearch-outbound   Up 10 seconds
    
    aerospike-tools                    Up 12 seconds
    
    elasticsearch                      Up 14 seconds (healthy)
    ```
    
    Elasticsearch may take a little longer to report `healthy` while the security stack initializes on first boot. If a container exits or does not become available, see [Troubleshoot](https://aerospike.com/docs/connectors/elasticsearch/learn/secure-with-tls/step/4/part/0/wrap-up#troubleshoot).
    
3.  Inspect the Elasticsearch connector’s TLS listener.
    
    Terminal
    
    Terminal
    
    ```bash
    openssl x509 \
    
      -in ./security/connector.aerospike.com.crt \
    
      -noout -issuer -ext subjectAltName
    
    openssl s_client -brief \
    
      -CAfile ./security/ca.crt \
    
      -cert ./security/asd.aerospike.com.crt \
    
      -key ./security/asd.aerospike.com.key \
    
      -verify_hostname connector.aerospike.com \
    
      -verify_return_error \
    
      -servername connector.aerospike.com \
    
      -connect localhost:8443 </dev/null
    ```
    
    Certificate and mTLS handshake
    
    Expected output
    
    ```text
    issuer=... mkcert development CA ...
    
    X509v3 Subject Alternative Name:
    
        DNS:connector.aerospike.com, ...
    
    CONNECTION ESTABLISHED
    
    Verification: OK
    
    ...
    ```
    
    The exact issuer text varies by machine. The SAN must include `DNS:connector.aerospike.com`, and the handshake must report `Verification: OK`. Supplying the Aerospike client certificate and key also verifies that the listener accepts the configured mTLS identity.
    
4.  Verify the listener rejects a client that does not present a certificate.
    
    Terminal
    
    Terminal
    
    ```bash
    if openssl s_client -brief \
    
      -CAfile ./security/ca.crt \
    
      -verify_hostname connector.aerospike.com \
    
      -verify_return_error \
    
      -servername connector.aerospike.com \
    
      -connect localhost:8443 </dev/null >/dev/null 2>&1; then
    
      echo 'Unexpected: connection succeeded without a client certificate' >&2
    
      false
    
    else
    
      echo 'Client certificate required'
    
    fi
    ```
    
    Client authentication result
    
    Expected output
    
    ```text
    Client certificate required
    ```
    
5.  Verify the Elasticsearch connector management endpoint is available on the loopback interface.
    
    Terminal
    
    ```bash
    curl -fsS 'http://localhost:8902/manage/rest/v1/metrics' > /dev/null
    ```
    
    The command exits without output when the endpoint responds successfully.
    

::: undefined
-   I’ve started the TLS-enabled Docker Compose stack.
-   I’ve verified the Elasticsearch connector mTLS listener accepts the Aerospike client certificate.
:::

[Previous  
Compose the stack](https://aerospike.com/docs/connectors/elasticsearch/learn/secure-with-tls/step/2/part/1/compose-stack) [Next  
Write and verify delivery](https://aerospike.com/docs/connectors/elasticsearch/learn/secure-with-tls/step/3/part/1/write-and-read)