Note S3 plugin uses JVM-wide truststore (#77676) (#77682)

Today it's not clear how to tell Elasticsearch to trust an S3-compatible repository that presents a certificate issued by a private or nonstandard CA. This commit expands the docs to say how. Supersedes #65034 Relates #77081 Co-authored-by: Joost De Cock <[email protected]> Co-authored-by: Joost De Cock <[email protected]> Co-authored-by: Joost De Cock <[email protected]>
elastic · Sep 14, 2021 · 0cde3da · 0cde3da
1 parent 108e432
commit 0cde3da
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/docs/plugins/repository-s3.asciidoc b/docs/plugins/repository-s3.asciidoc
@@ -125,7 +125,10 @@ settings belong in the `elasticsearch.yml` file.
 `protocol`::
 
     The protocol to use to connect to S3. Valid values are either `http` or
-    `https`. Defaults to `https`.
+    `https`. Defaults to `https`. When using HTTPS, this plugin validates the
+    repository's certificate chain using the JVM-wide truststore. Ensure that
+    the root certificate authority is in this truststore using the JVM's
+    `keytool` tool.
 
 `proxy.host`::