# AccessDeniedException when trying to startup ElasticSearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 29, 2019, 7:10am UTC](https://discuss.elastic.co/t/accessdeniedexception-when-trying-to-startup-elasticsearch/174484 "2019-03-29T07:10:39Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ordner](https://avatars.discourse-cdn.com/v4/letter/o/41988e/32.png) [@ordner](https://discuss.elastic.co/u/ordner)\ **Post date:** [March 29, 2019, 7:10am UTC](https://discuss.elastic.co/t/accessdeniedexception-when-trying-to-startup-elasticsearch/174484/1 "2019-03-29T07:10:39Z")
I am following this tutorial here: [https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication](https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication) After generating the certs and moving them to config/certs and adding this to elasticsearch.yml: ``` xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12 ``` I am getting `java.nio.file.AccessDeniedException: /usr/share/elasticsearch/config/certs/elastic-certificates.p12` when I try to start Elasticsearch. I have performed `curl -X POST "localhost:9200/_xpack/license/start_trial?acknowledge=true"` before and also initialized the built-in user's passwords. So what is the problem? my elastic user is in the wheel user group (CentOS 7) ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 29, 2019, 7:57am UTC](https://discuss.elastic.co/t/accessdeniedexception-when-trying-to-startup-elasticsearch/174484/2 "2019-03-29T07:57:12Z")
Hi, Did you change the permissions for the `/usr/share/elasticsearch/config` or `/usr/share/elasticsearch` after installation ? Can you share with us the output of ```auto ls -ld /usr/share/elasticsearch ls -ld /usr/share/elasticsearch/config ls -ld /usr/share/elasticsearch/config/certs ls -la /usr/share/elasticsearch/config/certs ``` ---
**Author:** ![ordner](https://avatars.discourse-cdn.com/v4/letter/o/41988e/32.png) [@ordner](https://discuss.elastic.co/u/ordner)\ **Post date:** [March 29, 2019, 9:05am UTC](https://discuss.elastic.co/t/accessdeniedexception-when-trying-to-startup-elasticsearch/174484/3 "2019-03-29T09:05:46Z")
Hi. Thanks for the reply. Here it is: ``` [elastic@a8a3b00a1cc5 elasticsearch]$ ls -ld /usr/share/elasticsearch drwxr-xr-x 9 elastic elastic 4096 Mar 29 06:20 /usr/share/elasticsearch [elastic@a8a3b00a1cc5 elasticsearch]$ ls -ld /usr/share/elasticsearch/config drwxr-xr-x 3 elastic elastic 4096 Mar 29 07:14 /usr/share/elasticsearch/config [elastic@a8a3b00a1cc5 elasticsearch]$ ls -ld /usr/share/elasticsearch/config/certs drwxr-xr-x 2 root root 4096 Mar 29 06:22 /usr/share/elasticsearch/config/certs [elastic@a8a3b00a1cc5 elasticsearch]$ ls -la /usr/share/elasticsearch/config/certs total 16 drwxr-xr-x 2 root root 4096 Mar 29 06:22 . drwxr-xr-x 3 elastic elastic 4096 Mar 29 07:14 .. -rw------- 1 root root 3451 Mar 29 06:05 elastic-certificates.p12 -rw------- 1 root root 2527 Mar 29 06:05 elastic-stack-ca.p12 ``` I assumed being a superuser, elastic and files activated by him can access any other files? So I also need to be the owner ?? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 29, 2019, 9:18am UTC](https://discuss.elastic.co/t/accessdeniedexception-when-trying-to-startup-elasticsearch/174484/4 "2019-03-29T09:18:44Z")
elasticsearch runs as `elastic` user in centos. You'd need to make `elastic` the owner of `certs` dir so that it can read the files from there, as now only root can read them ```auto drwxr-xr-x 2 root root 4096 Mar 29 06:22 . -rw------- 1 root root 3451 Mar 29 06:05 elastic-certificates.p12 -rw------- 1 root root 2527 Mar 29 06:05 elastic-stack-ca.p12 ``` You can do this with ```auto chown -R elastic:elastic /usr/share/elasticsearch/config/certs ``` as root. ---
**Author:** ![ordner](https://avatars.discourse-cdn.com/v4/letter/o/41988e/32.png) [@ordner](https://discuss.elastic.co/u/ordner)\ **Post date:** [March 29, 2019, 9:27am UTC](https://discuss.elastic.co/t/accessdeniedexception-when-trying-to-startup-elasticsearch/174484/5 "2019-03-29T09:27:54Z")
Thank you it works now 👍 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 26, 2019, 9:27am UTC](https://discuss.elastic.co/t/accessdeniedexception-when-trying-to-startup-elasticsearch/174484/6 "2019-04-26T09:27:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.