Add RCS Strong Verification Documentation #137822

jfreden · 2025-11-10T13:41:44Z

This adds documentation for the RCS Strong Verification feature added in #136299, #134137, #134893, #135674 and #134604.

elasticsearchmachine · 2025-11-10T13:42:09Z

Pinging @elastic/es-security (Team:Security)

elasticsearchmachine · 2025-11-10T13:42:09Z

Pinging @elastic/core-docs (Team:Docs)

github-actions · 2025-11-10T13:43:52Z

🔍 Preview links for changed docs

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

github-actions · 2025-11-10T13:43:53Z

ℹ️ Important: Docs version tagging

👋 Thanks for updating the docs! Just a friendly reminder that our docs are now cumulative. This means all 9.x versions are documented on the same page and published off of the main branch, instead of creating separate pages for each minor version.

We use applies_to tags to mark version-specific features and changes.

Expand for a quick overview

When to use applies_to tags:

✅ At the page level to indicate which products/deployments the content applies to (mandatory)
✅ When features change state (e.g. preview, ga) in a specific version
✅ When availability differs across deployments and environments

What NOT to do:

❌ Don't remove or replace information that applies to an older version
❌ Don't add new information that applies to a specific version without an applies_to tag
❌ Don't forget that applies_to tags can be used at the page, section, and inline level

🤔 Need help?

Check out the cumulative docs guidelines
Reach out in the #docs Slack channel

shainaraskas

a few questions and comments. overall, it would be good to understand whether these settings would apply to anything other than vanilla self-managed to vanilla self-managed connections.

cc-ing @eedugon because he's deep into this area and should probably also take a look

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

shainaraskas · 2025-11-10T18:09:20Z

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

+:   ([Secure](docs-content://deploy-manage/security/secure-settings.md)) Password for the truststore specified by `cluster.remote.signing.truststore.path`.
+
+`cluster.remote.signing.truststore.algorithm`
+:   ([Dynamic](docs-content://deploy-manage/stack-settings.md#dynamic-cluster-setting)) The algorithm for the truststore. Defaults to the default algorithm for the Java KeyManagerFactory.


would people know where this is? what options does this setting accept?

Changed it to specify the algorithm. Thanks!

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

shainaraskas · 2025-11-10T18:10:32Z

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

+:   ([Secure](docs-content://deploy-manage/security/secure-settings.md)) The passphrase that is used to decrypt the private key specified by `cluster.remote.<cluster_alias>.signing.key`. Since the key might not be encrypted, this value is optional.
+
+`cluster.remote.<cluster_alias>.signing.certificate`
+:   ([Dynamic](docs-content://deploy-manage/stack-settings.md#dynamic-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the signing key. This certificate is sent as part of the signature and must be trusted by the remote cluster's `cluster.remote.signing.certificate_authorities` or `cluster.remote.signing.truststore.path` configuration. This setting can be used only if `cluster.remote.<cluster_alias>.signing.key` is set.


Suggested change

: ([Dynamic](docs-content://deploy-manage/stack-settings.md#dynamic-cluster-setting)) Specifies the path for the PEM encoded certificate (or certificate chain) that is associated with the signing key. This certificate is sent as part of the signature and must be trusted by the remote cluster's `cluster.remote.signing.certificate_authorities` or `cluster.remote.signing.truststore.path` configuration. This setting can be used only if `cluster.remote.<cluster_alias>.signing.key` is set.

: ([Dynamic](docs-content://deploy-manage/stack-settings.md#dynamic-cluster-setting)) The path for the PEM encoded certificate (or certificate chain) that is associated with the signing key. This certificate is sent as part of the signature and must be trusted by the remote cluster's `cluster.remote.signing.certificate_authorities` or `cluster.remote.signing.truststore.path` configuration. This setting can be used only if `cluster.remote.<cluster_alias>.signing.key` is set.

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

gmjehovich · 2025-11-11T04:06:04Z

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

+
+### Request signing settings [remote-cluster-request-signing]
+
+The following per-cluster settings are used on the local cluster to sign outgoing cross-cluster requests. A private key and certificate 


Might want to clarify here that it will sign outgoing cross-cluster requests for connections to a certain alias (not global)

…usters.md Co-authored-by: shainaraskas <[email protected]>

jfreden · 2025-11-11T15:57:15Z

Thanks for the great review @shainaraskas !

overall, it would be good to understand whether these settings would apply to anything other than vanilla self-managed to vanilla self-managed connections.

This is general purpose but was built specifically for a customer running on ECH. Does that answer your question? Should this be added somewhere else to cover the ECH configuration in detail?

gmjehovich · 2025-11-12T00:54:54Z

I got a comment from Alex on the allowlist PR saying to be sure to include that these settings are cloud configurable https://github.com/elastic/cloud/pull/148921#pullrequestreview-3449669258

eedugon

Looks great! I've added a few minor comments for your consideration.

One thing that might be important is to mark the settings with the icon for cloud if they are available for ECE & ECH, but please confirm that with @shainaraskas , as I might be wrong ---> Update : this has been confirmed by @gmjehovich already, thanks!

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

eedugon · 2025-11-12T12:58:58Z

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

+private key and certificate must be configured for each remote cluster that requires signature verification.
+
+
+### PEM encoded files [remote-cluster-signing-pem-files]


Suggested change

### PEM encoded files [remote-cluster-signing-pem-files]

#### PEM encoded files [remote-cluster-signing-pem-files]

I think this should be inside Request signing settings. Please ignore otherwise!

eedugon · 2025-11-12T12:59:11Z

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

+:   ([Dynamic](docs-content://deploy-manage/stack-settings.md#dynamic-cluster-setting)) The path for the PEM encoded certificate (or certificate chain) that is associated with the signing key. This certificate is sent as part of the signature and must be trusted by the remote cluster's `cluster.remote.signing.certificate_authorities` or `cluster.remote.signing.truststore.path` configuration. This setting can be used only if `cluster.remote.<cluster_alias>.signing.key` is set.
+
+
+### Java keystore files [remote-cluster-signing-keystore-files]


Suggested change

### Java keystore files [remote-cluster-signing-keystore-files]

#### Java keystore files [remote-cluster-signing-keystore-files]

I think this should be inside Request signing settings. Please ignore otherwise!

shainaraskas · 2025-11-12T15:21:20Z

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

+## Remote cluster strong verification settings [remote-cluster-signing-settings]
+```{applies_to}
+deployment:
+  self: preview 9.3


this should be stack now (aka "all deployment types") because you confirmed it works for cloud. :)

Suggested change

self: preview 9.3

stack: preview 9.3

shainaraskas · 2025-11-12T15:23:33Z

@jfreden

This is general purpose but was built specifically for a customer running on ECH. Does that answer your question? Should this be added somewhere else to cover the ECH configuration in detail?

the reason I asked this is because, in your other PR, you added the content in a file specific to completely self-managed deployments. we'll need to refactor some stuff on that side so this information is surfaced appropriately. cc: @eedugon

shainaraskas · 2025-11-12T15:24:34Z

docs/reference/elasticsearch/configuration-reference/remote-clusters.md

+
+`cluster.remote.signing.truststore.algorithm`
+:   ([Dynamic](docs-content://deploy-manage/stack-settings.md#dynamic-cluster-setting)) The algorithm for the truststore. Defaults to 
+`SunX509`.


are there any limitations on what algorithms can be used?

Yes, it's very limited SunX509 or PKIX are the common ones. This is copied from https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/security-settings#ref-pki-settings (truststore.algorithm)

bytebilly

LGTM (pending discussion on the naming raised in the other doc PR)

…usters.md Co-authored-by: Edu González de la Herrán <[email protected]>

jfreden · 2025-11-13T13:10:40Z

I've addressed all the comments and also talked to @eedugon over zoom. He's working on a refactor of this section so will go ahead and merge it as is and he will work further with organising this documentation. Thanks all!

This adds documentation for the RCS Strong Verification feature added in elastic/elasticsearch#136299, elastic/elasticsearch#134137, elastic/elasticsearch#134893, elastic/elasticsearch#135674 and elastic/elasticsearch#134604. Related settings docs PR: elastic/elasticsearch#137822 --------- Co-authored-by: shainaraskas <[email protected]> Co-authored-by: Edu González de la Herrán <[email protected]>

…-json * upstream/main: (158 commits) Cleanup files from repo root folder (elastic#138030) Implement OpenShift AI integration for chat completion, embeddings, and reranking (elastic#136624) Optimize AsyncSearchErrorTraceIT to avoid failures (elastic#137716) Removes support for null TransportService in RemoteClusterService (elastic#137939) Mute org.elasticsearch.index.mapper.DateFieldMapperTests testSortShortcuts elastic#138018 rest-api-spec: fix type of enums (elastic#137521) Update Gradle wrapper to 9.2.0 (elastic#136155) Add RCS Strong Verification Documentation (elastic#137822) Use docvalue skippers on dimension fields (elastic#137029) Introduce INDEX_SHARD_COUNT_FORMAT (elastic#137210) Mute org.elasticsearch.xpack.inference.integration.AuthorizationTaskExecutorIT testCreatesChatCompletion_AndThenCreatesTextEmbedding elastic#138012 Fix ES|QL search context creation to use correct results type (elastic#137994) Improve Snapshot Logging (elastic#137470) Support extra output field in TOP function (elastic#135434) Remove NumericDoubleValues class (elastic#137884) [ML] Fix ML calendar event update scalability issues (elastic#136886) Task may be unregistered outside of the trace context in exceptional cases. (elastic#137865) Refine workaround for S3 repo analysis known issue (elastic#138000) Additional DEBUG logging on authc failures (elastic#137941) Cleanup index resolution (elastic#137867) ...

Add RCS Strong Verification Documentation

5135585

jfreden requested a review from gmjehovich November 10, 2025 13:41

jfreden added >docs General docs changes :Security/Security Security issues without another label labels Nov 10, 2025

elasticsearchmachine added Team:Docs Meta label for docs team Team:Security Meta label for security team v9.3.0 labels Nov 10, 2025

jfreden mentioned this pull request Nov 10, 2025

Add RCS Strong Verification Documentation elastic/docs-content#3864

Closed

jfreden requested a review from bytebilly November 10, 2025 13:47

fixup! Tech preview disclaimer

5001d43

jfreden mentioned this pull request Nov 10, 2025

Add RCS Strong Verification Documentation elastic/docs-content#3865

Merged

shainaraskas reviewed Nov 10, 2025

View reviewed changes

gmjehovich reviewed Nov 11, 2025

View reviewed changes

jfreden and others added 9 commits November 11, 2025 16:15

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

bf7ce5e

…usters.md Co-authored-by: shainaraskas <[email protected]>

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

a06c9ac

…usters.md Co-authored-by: shainaraskas <[email protected]>

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

c2ecc54

…usters.md Co-authored-by: shainaraskas <[email protected]>

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

0ba9232

…usters.md Co-authored-by: shainaraskas <[email protected]>

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

58eb898

…usters.md Co-authored-by: shainaraskas <[email protected]>

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

6714ac3

…usters.md Co-authored-by: shainaraskas <[email protected]>

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

b1ca094

…usters.md Co-authored-by: shainaraskas <[email protected]>

fixup! Code review comments

c56f2fb

fixup! Code review comments

1aaba2b

eedugon approved these changes Nov 12, 2025

View reviewed changes

shainaraskas reviewed Nov 12, 2025

View reviewed changes

bytebilly approved these changes Nov 13, 2025

View reviewed changes

jfreden and others added 4 commits November 13, 2025 13:24

Update docs/reference/elasticsearch/configuration-reference/remote-cl…

58b56b0

…usters.md Co-authored-by: Edu González de la Herrán <[email protected]>

fixup! Code review

a2bb187

fixup! Syntax

cf60476

fixup! Syntax

a04d9da

Merge branch 'main' into add_docs_rcs_strong_ver

bfb9616

jfreden enabled auto-merge (squash) November 13, 2025 13:11

jfreden merged commit 298c76c into elastic:main Nov 13, 2025
11 checks passed


		### Request signing settings [remote-cluster-request-signing]

		The following per-cluster settings are used on the local cluster to sign outgoing cross-cluster requests. A private key and certificate

		private key and certificate must be configured for each remote cluster that requires signature verification.


		### PEM encoded files [remote-cluster-signing-pem-files]

	### PEM encoded files [remote-cluster-signing-pem-files]
	#### PEM encoded files [remote-cluster-signing-pem-files]

		: ([Dynamic](docs-content://deploy-manage/stack-settings.md#dynamic-cluster-setting)) The path for the PEM encoded certificate (or certificate chain) that is associated with the signing key. This certificate is sent as part of the signature and must be trusted by the remote cluster's `cluster.remote.signing.certificate_authorities` or `cluster.remote.signing.truststore.path` configuration. This setting can be used only if `cluster.remote.<cluster_alias>.signing.key` is set.


		### Java keystore files [remote-cluster-signing-keystore-files]

	### Java keystore files [remote-cluster-signing-keystore-files]
	#### Java keystore files [remote-cluster-signing-keystore-files]

Add RCS Strong Verification Documentation #137822

Add RCS Strong Verification Documentation #137822

Uh oh!

Conversation

jfreden commented Nov 10, 2025

Uh oh!

elasticsearchmachine commented Nov 10, 2025

Uh oh!

elasticsearchmachine commented Nov 10, 2025

Uh oh!

github-actions bot commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions bot commented Nov 10, 2025

ℹ️ Important: Docs version tagging

When to use applies_to tags:

What NOT to do:

🤔 Need help?

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jfreden commented Nov 11, 2025

Uh oh!

gmjehovich commented Nov 12, 2025

Uh oh!

eedugon left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shainaraskas commented Nov 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bytebilly left a comment

Choose a reason for hiding this comment

Uh oh!

jfreden commented Nov 13, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

github-actions bot commented Nov 10, 2025 •

edited

Loading

eedugon left a comment •

edited

Loading