Help Center/ Cloud Search Service/ FAQs/ Managing CSS Clusters/ How Do I Modify the TLS Algorithm for a CSS Cluster?
Updated on 2026-01-09 GMT+08:00
View PDF
Share

How Do I Modify the TLS Algorithm for a CSS Cluster?

The TLS algorithm can be modified for Elasticsearch 7.6.2 and later as well as OpenSearch clusters.

  1. Log in to the CSS management console.
  2. In the navigation pane on the left, expand Clusters. Select a cluster type based on the target cluster. The cluster list is displayed.
  3. In the cluster list, click the name of the target cluster. The cluster information page is displayed.
  4. Choose Cluster Settings > Parameter Settings.
  5. Click the OpenSearch or Elasticsearch tab, depending on your cluster type.
  6. Click Edit, expand Custom, and click Add.
    • For an Elasticsearch cluster, add the following parameter:

      Parameter: opendistro_security.ssl.http.enabled_ciphers

      Value: ['TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384']

    • For an OpenSearch cluster, add the following parameter:

      Parameter: plugins.security.ssl.http.enabled_ciphers

      Value: ['TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384']

    If Value contains multiple algorithms/protocols, enclose them using a pair of square brackets. If it contains only a single algorithm/protocol, enclose it using a pair of single quotation marks.

  7. After the change is complete, click Submit. In the displayed dialog box, confirm the settings, select the box indicating "I understand that the modification will take effect after the cluster is restarted." and click Yes.

    If the Status is Succeeded in the parameter change list, the change has been saved.

  8. Click Restart in the upper right corner to restart the cluster, thus making the change take effect.
Parent topic: Managing CSS Clusters