# How to scure and authenticate opensearch-client

**URL:** <https://forum.opensearch.org/t/how-to-scure-and-authenticate-opensearch-client/28137>\
**Category:** OpenSearch\
**Tags:** discuss, troubleshoot, configure\
**Created:** [June 17, 2026, 7:37pm UTC](https://forum.opensearch.org/t/how-to-scure-and-authenticate-opensearch-client/28137 "2026-06-17T19:37:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![abdul](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@abdul](https://forum.opensearch.org/u/abdul)\
**Post date:** [June 17, 2026, 7:37pm UTC](https://forum.opensearch.org/t/how-to-scure-and-authenticate-opensearch-client/28137/1 "2026-06-17T19:37:18Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
3.2.1

**Describe the issue** :  
how to scure and authenticate opensearch-client

**Configuration** :

**Relevant Logs or Screenshots** :

 ![532eb9a3-b947-454a-af90-93a15e80d65b](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/f/fde1c19a7ab9129ba70352c964f4a051236f05f2.jpeg)

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [June 17, 2026, 10:41pm UTC](https://forum.opensearch.org/t/how-to-scure-and-authenticate-opensearch-client/28137/2 "2026-06-17T22:41:13Z")

</div>

Hi @abdul, The question is very broad, also I assume you are referring to OpenSearch version 3.2.0.

As an example you can use the following docker compose file to spin up a secure single node cluster:

```auto
services:
  opensearch:
    image: opensearchproject/opensearch:3.2.0
    container_name: opensearch-client-auth
    environment:
      - discovery.type=single-node
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=MyR3pr0@Secur3!
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - bootstrap.memory_lock=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "9200:9200"
    healthcheck:
      test: ["CMD-SHELL", "curl -sku admin:'MyR3pr0@Secur3!' https://localhost:9200/_cluster/health | grep -qE '\"status\":\"(green|yellow)\"'"]
      interval: 15s
      timeout: 10s
      retries: 40

```

You can use the below python client script to connect to the secure cluster using `opensearchpy`:

```auto

from opensearchpy import OpenSearch

HOST = "localhost"
PORT = 9200
AUTH = ("admin", "MyR3pr0@Secur3!")
CA_CERT = "root-ca.pem" # extracted from the container, see README

def connect_verified():
    """Recommended: verify the server cert against the cluster's CA."""
    client = OpenSearch(
        hosts=[{"host": HOST, "port": PORT}],
        http_auth=AUTH,
        use_ssl=True,
        verify_certs=True,
        ca_certs=CA_CERT,
    )
    print("verify_certs=True ->", client.info())
    return client

def connect_insecure():
    """Quick local testing only: skips CA verification entirely."""
    client = OpenSearch(
        hosts=[{"host": HOST, "port": PORT}],
        http_auth=AUTH,
        use_ssl=True,
        verify_certs=False,
        ssl_show_warn=False,
    )
    print("verify_certs=False ->", client.info())
    return client

if __name__ == " __main__":
    connect_insecure()
    connect_verified()

```

Do you have a specific question regarding securing a cluster?

---

<div class="post-metadata">

**Author:** ![abdul](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@abdul](https://forum.opensearch.org/u/abdul)\
**Post date:** [June 18, 2026, 6:51am UTC](https://forum.opensearch.org/t/how-to-scure-and-authenticate-opensearch-client/28137/3 "2026-06-18T06:51:51Z")

</div>

I would like to configure this using Helm. Could you please guide me on how to do it? My OpenSearch cluster and OpenSearch Dashboard are already deployed and running through Helm.

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [June 18, 2026, 8:57am UTC](https://forum.opensearch.org/t/how-to-scure-and-authenticate-opensearch-client/28137/4 "2026-06-18T08:57:35Z")

</div>

@abdul for security, are you attempting to use demo certificates generated by OpenSearch, or provide your own certificates and CA?

Also, can you please provide your current values.yml file for this cluster.