# Query: To run securityadmin.sh when TLS is disabled on Rest layer
**URL:** https://forum.opensearch.org/t/query-to-run-securityadmin-sh-when-tls-is-disabled-on-rest-layer/10281
**Category:** Security
**Created:** [July 18, 2022, 7:04am UTC](https://forum.opensearch.org/t/query-to-run-securityadmin-sh-when-tls-is-disabled-on-rest-layer/10281 "2022-07-18T07:04:42Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Pratiksha](https://forum.opensearch.org/u/Pratiksha)
#### Post date: [July 18, 2022, 7:04am UTC](https://forum.opensearch.org/t/query-to-run-securityadmin-sh-when-tls-is-disabled-on-rest-layer/10281/1 "2022-07-18T07:04:42Z")
I am trying to set up an OpenSearch cluster with security with TLS being disabled on Rest layer as TLS is optional for Rest layer in OpenSearch. However, As of Opensearch v2.0, securityadmin.sh can be run on http port of opensearch cluster. I am getting below error when trying to run security admin:
```auto
ERR: An unexpected IOException occured: Unrecognized SSL message, plaintext connection?
Trace:
java.io.IOException: Unrecognized SSL message, plaintext connection?
at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:927)
at org.opensearch.client.RestClient.performRequest(RestClient.java:307)
at org.opensearch.client.RestClient.performRequest(RestClient.java:295)
at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:462)
at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:159)
Caused by: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:146)
at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:64)
at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:557)
at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:454)
at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:433)
at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:637)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:275)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:321)
at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:523)
at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120)
at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276)
at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:591)
at java.base/java.lang.Thread.run(Thread.java:829)
```
Kindly Provide a way to run above use case where we have disabled TLS on Rest layer and need to run securityadmin.sh.
As per the error message, looks like it is a BUG as the setting “plugins.security.ssl.http.enabled” is of no use as it cannot be disabled, because securityadmin.sh will not be able to run.
---
### Author:  [@pablo](https://forum.opensearch.org/u/pablo)
#### Post date: [July 18, 2022, 10:39am UTC](https://forum.opensearch.org/t/query-to-run-securityadmin-sh-when-tls-is-disabled-on-rest-layer/10281/2 "2022-07-18T10:39:14Z")
@Pratiksha As per security plugin design, the admin tasks in plugin config can be taken only by the admin user defined in `plugins.security.authcz.admin_dn`.
This requires a secured connection to OpenSearch with admin user certificates.
The securityadmin.sh, only follows this logic.