# Cannot initialize SSL - Invalid keystore format

**URL:** <https://discuss.elastic.co/t/cannot-initialize-ssl-invalid-keystore-format/223615>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [March 14, 2020, 12:52pm UTC](https://discuss.elastic.co/t/cannot-initialize-ssl-invalid-keystore-format/223615 "2020-03-14T12:52:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![YaSe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yase/32/52227_2.png) [@YaSe](https://discuss.elastic.co/u/YaSe)\
**Post date:** [March 14, 2020, 12:52pm UTC](https://discuss.elastic.co/t/cannot-initialize-ssl-invalid-keystore-format/223615/1 "2020-03-14T12:52:27Z")

</div>

Hello all,

I have installed an Elasticsearch cluster (ECK) in my Kubernetes cluster (GKE) by using this [tutorial](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html#k8s-deploy-eck).

I retrived the [CA certificat tls.crt](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html#k8s-request-elasticsearch-endpoint) created by my ECK. Then, I used the following command to create a truststore.jks

```
keytool -import -trustcacerts -alias ca_root -file tls.crt -keystore truststore.jks

PS: I am using openjdk version "1.8.0_242"

```

Then, I create a Kubernetes secret:

```
apiVersion: v1
kind: Secret
metadata:
  name: elasticsearch-truststore-secret
  namespace: dev
type: Opaque
data:
  truststore.jks: <<content of truststore.jks in base64>>

```

Finally, I specified in the configuration of my spark job, the following information:

```
spark.es.nodes.wan.only true
spark.es.index.auto.create true
spark.es.nodes https://smart-agriculture-elasticsearch-es-http
spark.es.port 9200
spark.es.net.http.auth.user elastic
spark.es.net.http.auth.pass <<password of elastic user>>
spark.es.net.ssl true
spark.es.net.ssl.cert.allow.self.signed true
spark.es.net.ssl.truststore.location file:///etc/secrets/elasticsearch/truststore.jks
spark.es.net.ssl.truststore.pass test1234
spark.kubernetes.driver.secrets.elasticsearch-truststore-secret /etc/secrets/elasticsearch/truststore.jks
spark.kubernetes.executor.secrets.elasticsearch-truststore-secret /etc/secrets/elasticsearch/truststore.jks

```

I got the following error:

```
Caused by: java.io.IOException: Invalid keystore format at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:663) at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56) at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224) at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70) at java.security.KeyStore.load(KeyStore.java:1445) at org.elasticsearch.hadoop.rest.commonshttp.SSLSocketFactory.loadKeyStore(SSLSocketFactory.java:200) at org.elasticsearch.hadoop.rest.commonshttp.SSLSocketFactory.loadTrustManagers(SSLSocketFactory.java:226) at org.elasticsearch.hadoop.rest.commonshttp.SSLSocketFactory.createSSLContext(SSLSocketFactory.java:173) ... 41 more

```

I don't know what I am doing wrong.  
Does anyone know how to solve this ?

---

<div class="post-metadata">

**Author:** ![YaSe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yase/32/52227_2.png) [@YaSe](https://discuss.elastic.co/u/YaSe)\
**Post date:** [March 17, 2020, 10:19am UTC](https://discuss.elastic.co/t/cannot-initialize-ssl-invalid-keystore-format/223615/2 "2020-03-17T10:19:20Z")

</div>

A little bit of help please, I didn't find a way ☹ !  
Thanks

---

<div class="post-metadata">

**Author:** ![YaSe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yase/32/52227_2.png) [@YaSe](https://discuss.elastic.co/u/YaSe)\
**Post date:** [March 20, 2020, 1:30pm UTC](https://discuss.elastic.co/t/cannot-initialize-ssl-invalid-keystore-format/223615/3 "2020-03-20T13:30:33Z")

</div>

Solution in [How to create Keystore and Truststore from CA Certificates](https://discuss.elastic.co/t/how-to-create-keystore-and-truststore-from-ca-certificates/224156/5)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 7:49am UTC](https://discuss.elastic.co/t/cannot-initialize-ssl-invalid-keystore-format/223615/4 "2022-11-04T07:49:17Z")

</div>