You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/client-concepts/certificates/working-with-certificates.asciidoc
+21-18
Original file line number
Diff line number
Diff line change
@@ -17,25 +17,31 @@ please modify the original csharp file found at the link and submit the PR with
17
17
18
18
=== Server Certificates
19
19
20
-
If you've enabled SSL on elasticsearch with x-pack or through a proxy in front of elasticsearch and the Certificate Authority (CA)
20
+
If you've enabled SSL on Elasticsearch with x-pack or through a proxy in front of elasticsearch and the Certificate Authority (CA)
21
21
That generated the certificate is trusted by the machine running the client code there should be nothing you'll have to do to to talk
22
22
to over https with the client. If you are using your own CA which is not trusted .NET won't allow you to make https calls to that endpoint.
23
23
24
-
.NET allows you to preempt this though through a custom validation through the the global static `ServicePointManager.ServerCertificateValidationCallback`.
24
+
In .NET, you can preempt this though through a custom validation through the the global static `ServicePointManager.ServerCertificateValidationCallback`.
25
25
Most examples you will find on the .NET will simply return `true` from this delegate and call it quits. This is not advisable as this will allow any HTTPS
26
26
traffic in the current AppDomain and not run any validations. Imagine you deploy a web app that talks to Elasticsearch over HTTPS but also some third party
27
-
SOAP/WSDL endpoint setting `ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, errors) => true;` will skip validation of BOTH
28
-
Elasticsearch and that external web service.
27
+
SOAP/WSDL endpoint setting
29
28
30
-
.NET also allows you to set that callback per service endpoint and Elasticsearch.NET/NEST exposes this through connection settings.
31
-
You can do your own validation in that handler or simply assign baked in handler that we ship with out of the box on the static
will skip validation for *both* Elasticsearch *and* that external web service.
33
35
34
-
The two most basic ones are `AllowAll` and `DenyAll` which does accept or deny any ssl trafic to our nodes`:
36
+
You can also set a callback per service endpoint with .NET, and Elasticsearch.NET/NEST exposes this through the
37
+
connection settings; You can do your own validation in that handler or simply assign one of the baked in handlers
38
+
that we ship with out of the box, on the static class `CertificateValidations`.
35
39
36
-
If your client application however has access to the public CA certificate locally Elasticsearch.NET/NEST ships with handy helpers that assert
37
-
that the certificate that the server presented was one that came from our local CA certificate. If you use x-pack's `certgen` tool to
38
-
[generate SSL certificates] https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html)[] the generated node certificate does not include the CA in the
40
+
The two most basic ones are `AllowAll` and `DenyAll`, which accept or deny any SSL traffic to our nodes, respectively
41
+
42
+
If your client application however has access to the public CA certificate locally, Elasticsearch.NET/NEST ships with handy helpers that assert
43
+
that the certificate that the server presented was one that came from our local CA certificate. If you use X-Pack's `certgen` tool to
44
+
{xpack_current}/ssl-tls.html[generate SSL certificates], the generated node certificate does not include the CA in the
39
45
certificate chain. This to cut back on SSL handshake size. In those case you can use `CertificateValidations.AuthorityIsRoot` and pass it your local copy
40
46
of the CA public key to assert that the certificate the server presented was generated off that.
41
47
@@ -47,9 +53,9 @@ generate the servers key.
47
53
48
54
=== Client Certificates
49
55
50
-
X-Pack also allows you to configure a [PKI realm] https://www.elastic.co/guide/en/x-pack/current/pki-realm.html)[] to enable user authentication
56
+
X-Pack also allows you to configure a {xpack_current}/pki-realm.html[PKI realm] to enable user authentication
51
57
through client certificates. The `certgen` tool included with X-Pack allows you to
52
-
[generate client certificates as well] https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html#CO13-4)[] and assign the distinguished name (DN) of the
58
+
{xpack_current}/ssl-tls.html#CO13-4[generate client certificates as well] and assign the distinguished name (DN) of the
53
59
certificate as a user with a certain role.
54
60
55
61
certgen by default only generates a public certificate `.cer`) and a private key `.key`. To authenticate with client certificates you need to present both
@@ -63,15 +69,13 @@ You can set Client Certificates to use on all connections on `ConnectionSettings
63
69
64
70
Or per request on `RequestConfiguration` which will take precedence over the ones defined on `ConnectionConfiguration`
65
71
66
-
=== Object Initializer Syntax Example
67
-
68
72
[source,csharp]
69
73
----
70
74
new RootNodeInfoRequest
71
75
{
72
76
RequestConfiguration = new RequestConfiguration
73
77
{
74
-
ClientCertificates = new X509Certificate2Collection { new X509Certificate2(this.BadCertificate) }
78
+
ClientCertificates = new X509Certificate2Collection { new X509Certificate2(this.Certificate) }
Copy file name to clipboardExpand all lines: docs/client-concepts/high-level/inference/field-inference.asciidoc
-4
Original file line number
Diff line number
Diff line change
@@ -523,13 +523,9 @@ class Precedence
523
523
}
524
524
----
525
525
<1> Even though this property has a NEST property mapping _and_ a `JsonProperty` attribute, We are going to provide a hard rename for it on ConnectionSettings later that should win.
526
-
527
526
<2> This property has both a NEST attribute and a `JsonProperty`, NEST should win.
528
-
529
527
<3> We should take the json property into account by itself
530
-
531
528
<4> This property we are going to special case in our custom serializer to resolve to ask
532
-
533
529
<5> We are going to register a DefaultFieldNameInferrer on ConnectionSettings that will uppercase all properties.
534
530
535
531
Here we create a custom serializer that renames any property named `AskSerializer` to `ask`
<3> The index names here come from the Connection Settings passed to `TestClient`. See the documentation on <<index-name-inference, Index Name Inference>> for more details.
Copy file name to clipboardExpand all lines: docs/client-concepts/low-level/connecting.asciidoc
-8
Original file line number
Diff line number
Diff line change
@@ -91,9 +91,7 @@ var client = new ElasticLowLevelClient(config);
91
91
var result = client.Search<SearchResponse<object>>(new { size = 12 });
92
92
----
93
93
<1> Disable automatic proxy detection. When called, defaults to `true`.
94
-
95
94
<2> Enable compressed request and responses from Elasticsearch (Note that nodes need to be configured to allow this. See the {ref_current}/modules-http.html[http module settings] for more info).
96
-
97
95
<3> By default responses are deserialized directly from the response stream to the object you tell it to. For debugging purposes, it can be very useful to keep a copy of the raw response on the result object, which is what calling this method will do.
98
96
99
97
`.ResponseBodyInBytes` will only have a value if the client configuration has `DisableDirectStreaming` set
@@ -131,13 +129,9 @@ config = config
131
129
.BasicAuthentication("username", "password");
132
130
----
133
131
<1> Allows you to set querystring parameters that have to be added to every request. For instance, if you use a hosted elasticserch provider, and you need need to pass an `apiKey` parameter onto every request.
134
-
135
132
<2> Sets proxy information on the connection.
136
-
137
133
<3> [[request-timeout]] Sets the global maximum time a connection may take. Please note that this is the request timeout, the builtin .NET `WebRequest` has no way to set connection timeouts (see http://msdn.microsoft.com/en-us/library/system.net.httpwebrequest.timeout(v=vs.110).aspx[the MSDN documentation on `HttpWebRequest.Timeout` Property]).
138
-
139
134
<4> As an alternative to the C/go like error checking on `response.IsValid`, you can instead tell the client to <<thrown-exceptions, throw exceptions>>.
140
-
141
135
<5> forces all serialization to be indented and appends `pretty=true` to all the requests so that the responses are indented as well
142
136
143
137
NOTE: Basic authentication credentials can alternatively be specified on the node URI directly:
@@ -359,8 +353,6 @@ public class MyJsonNetSerializer : JsonNetSerializer
359
353
}
360
354
----
361
355
<1> Call this constructor if you only need access to `JsonSerializerSettings` without local state (properties on MyJsonNetSerializer)
362
-
363
356
<2> Call OverwriteDefaultSerializers if you need access to `JsonSerializerSettings` with local state
364
-
365
357
<3> You can inject contract resolved converters by implementing the ContractConverters property. This can be much faster then registering them on `JsonSerializerSettings.Converters`
0 commit comments