---
title: >-
  Elasticsearch domain connections should be encrypted using a secure TLS
  version
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Elasticsearch domain connections should
  be encrypted using a secure TLS version
---

# Elasticsearch domain connections should be encrypted using a secure TLS version
 
## Description{% #description %}

This control verifies whether an Elasticsearch domain endpoint uses a secure TLS security policy. It will fail if HTTPS isn't enabled or if the endpoint isn't configured with an allowed policy. Allowed policies are Policy-Min-TLS-1-2-PFS-2023-10 and Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08.

Using HTTPS (TLS) can help thwart attackers from conducting person-in-the-middle or similar attacks aimed at intercepting or altering network traffic. It's essential to permit only encrypted connections over HTTPS (TLS). Be aware that encrypting data during transmission can impact performance, so you should test your application with this feature enabled to understand the performance implications. TLS 1.2 offers significant security improvements over earlier versions of TLS.

## Remediation{% #remediation %}

To enable TLS encryption, use the [UpdateDomainConfig API operation](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpdateDomainConfig.html) to configure the [DomainEndpointOptions object](https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DomainEndpointOptions.html). This action sets the `TLSSecurityPolicy`.