# Client unable to trust server certificate **URL:** \ **Category:** Elasticsearch\ **Created:** [March 12, 2020, 7:37pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404 "2020-03-12T19:37:21Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![brb44](https://avatars.discourse-cdn.com/v4/letter/b/c6cbf5/32.png) [@brb44](https://discuss.elastic.co/u/brb44)\ **Post date:** [March 12, 2020, 7:37pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404/1 "2020-03-12T19:37:22Z")
Hi, I'm getting below error when I tried to enabling transport ssl. `Caused by: sun.security.validator.ValidatorException: Extended key usage does not permit use for TLS client authentication at sun.security.validator.EndEntityChecker.checkTLSClient(EndEntityChecker.java:238) ~[?:?] at sun.security.validator.EndEntityChecker.check(EndEntityChecker.java:145) ~[?:?] at sun.security.validator.Validator.validate(Validator.java:274) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:279) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(X509TrustManagerImpl.java:130) ~[?:?] at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1970) ~[?:?] at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:232) ~[?:?] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_202] at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:?] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1457) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1365) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1199) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1243) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final]` `client did not trust this server's certificate, closing connection NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:41990, remoteAddress=/10.x.x.x:9300` Config file: elasticsearch.yml xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: full xpack.security.transport.ssl.key: /etc/elasticsearch/certs/elastic2.key xpack.security.transport.ssl.certificate: /etc/elasticsearch/certs/elastic2.cer xpack.security.transport.ssl.certificate\_authorities: ["/etc/elasticsearch/certs/chain.cer"] Commands used to generate the certificate: elasticsearch-certutil csr -in config/instance.yml I signed the certificates using origanisation CA. Please help me in getting this issue resolved. ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [March 12, 2020, 7:43pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404/2 "2020-03-12T19:43:10Z")
> [@brb44](#): > > xpack.security.transport.ssl.certificate: /etc/elasticsearch/certs/elastic2.cer > xpack.security.transport.ssl.certificate\_authorities: ["/etc/elasticsearch/certs/chain.cer"] Is the elastic2.cer a single certificate? We cdhanged that to a PCKS#7 "bundle" that contains the cert and CA chain. See this [Elasticsearch X-Pack valid ssl certificate not trusted by client because ca chain not provided by server. · Issue #31725 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/31725) ---
**Author:** ![brb44](https://avatars.discourse-cdn.com/v4/letter/b/c6cbf5/32.png) [@brb44](https://discuss.elastic.co/u/brb44)\ **Post date:** [March 12, 2020, 7:49pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404/3 "2020-03-12T19:49:49Z")
Hi @rugenl yes it is a single certificate and I used our org CA in certificate authorities. first I generated the certificates using certutil and signed them and place them on other two nodes. first I though the java keystore is not trusting the ca and tried adding to the keystore. still after trying various getting the same error. ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [March 12, 2020, 8:00pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404/4 "2020-03-12T20:00:00Z")
A work around is to specify the ca chain in the client. See the bottom page of the github issue, the 2nd from the last post. ---
**Author:** ![brb44](https://avatars.discourse-cdn.com/v4/letter/b/c6cbf5/32.png) [@brb44](https://discuss.elastic.co/u/brb44)\ **Post date:** [March 12, 2020, 10:05pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404/5 "2020-03-12T22:05:01Z")
I tried changing the certificate to pkcs#7. I'm getting below error. `Caused by: sun.security.validator.ValidatorException: Extended key usage does not permit use for TLS client authentication at sun.security.validator.EndEntityChecker.checkTLSClient(EndEntityChecker.java:238) ~[?:?] at sun.security.validator.EndEntityChecker.check(EndEntityChecker.java:145) ~[?:?] at sun.security.validator.Validator.validate(Validator.java:274) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:279) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(X509TrustManagerImpl.java:130) ~[?:?] at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1970) ~[?:?] at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:232) ~[?:?] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_202] at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:?] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1457) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1365) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1199) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1243) ~[netty-handler-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-codec-4.1.30.Final.jar:4.1.30.Final] ... 15 more` Any views? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 9, 2020, 10:05pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404/6 "2020-04-09T22:05:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.