The server half of mutual TLS: by default Elasticsearch does not request a client certificate (security settings). Add support for xpack.security.http.ssl.client_authentication (optional / required) so ES requests and validates a client certificate on the HTTP layer.
Without this, any client certificate presented by Beats/Logstash/Kibana is ignored (which is exactly today's state). Requires HTTP TLS to be on (elasticsearch_http_security). Opt-in, default none (unchanged behaviour).
Foundation for the client-side children — they depend on this. Part of #536. 2.0.0.
The server half of mutual TLS: by default Elasticsearch does not request a client certificate (security settings). Add support for
xpack.security.http.ssl.client_authentication(optional/required) so ES requests and validates a client certificate on the HTTP layer.Without this, any client certificate presented by Beats/Logstash/Kibana is ignored (which is exactly today's state). Requires HTTP TLS to be on (
elasticsearch_http_security). Opt-in, defaultnone(unchanged behaviour).Foundation for the client-side children — they depend on this. Part of #536. 2.0.0.