anchor.diff:  [[connect-ec]]
   === Connecting to Elastic Cloud
   
  -https://www.elastic.co/guide/en/cloud/current/ec-getting-started.html[Elastic Cloud] is the easiest way to get started with Elasticsearch. When connecting to Elastic Cloud with the Python Elasticsearch client you should always use the `cloud_id` parameter to connect. You can find this value within the "Manage Deployment" page after you've created a cluster (look in the top-left if you're in Kibana).
  -
  -We recommend using a Cloud ID whenever possible because your client will be automatically configured for optimal use with Elastic Cloud including HTTPS and HTTP compression.
  +https://www.elastic.co/guide/en/cloud/current/ec-getting-started.html[Elastic Cloud] 
  +is the easiest way to get started with {es}. When connecting to Elastic Cloud 
  +with the Python {es} client you should always use the `cloud_id` 
  +parameter to connect. You can find this value within the "Manage Deployment" 
  +page after you've created a cluster (look in the top-left if you're in Kibana).
  +
  +We recommend using a Cloud ID whenever possible because your client will be 
  +automatically configured for optimal use with Elastic Cloud including HTTPS and 
  +HTTP compression.
   
   [source,python]
   ----
  
positive.code: ->  HTTP CA certificate SHA-256 fingerprint:
    a52dd93511e8c6045e21f16654b77c9ee0f34aea26d9f40320b531c474676228
  ...
  \----------------------------------------------------------------------
  ----
  
  Note down the `elastic` user password and HTTP CA fingerprint for the next sections. In the examples below they will be stored in the variables `ELASTIC_PASSWORD` and `CERT_FINGERPRINT` respectively.
  
  Depending on the circumstances there are two options for verifying the HTTPS connection, either verifying with the CA certificate itself or via the HTTP CA certificate fingerprint.
  
  [discrete]
  ==== Verifying HTTPS with CA certificates
  
  Using the `ca_certs` option is the default way the Python Elasticsearch client verifies an HTTPS connection.
  
  The generated root CA certificate can be found in the `certs` directory in your Elasticsearch config location (`$ES_CONF_PATH/certs/http_ca.crt`). If you're running Elasticsearch in Docker there is https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html[additional documentation for retrieving the CA certificate].
  
  Once you have the `http_ca.crt` file somewhere accessible pass the path to the client via `ca_certs`:
  
  [source,python]
  ----
  
negative.code: # {'name': 'instance-0000000000', 'cluster_name': ...}
  ----
  
  The certificate fingerprint can be calculated using `openssl x509` with the 
  certificate file:
  
  [source,sh]
  ----
  openssl x509 -fingerprint -sha256 -noout -in /path/to/http_ca.crt
  ----
  
  If you don't have access to the generated CA file from {es} you can use the 
  following script to output the root CA fingerprint of the {es} instance with 
  `openssl s_client`:
  
  [source,sh]
  ----
  