# Closing connection Netty4HttpChannel Error
**URL:** https://discuss.elastic.co/t/closing-connection-netty4httpchannel-error/381108
**Category:** Elasticsearch
**Tags:** docker
**Created:** [August 18, 2025, 11:31am UTC](https://discuss.elastic.co/t/closing-connection-netty4httpchannel-error/381108 "2025-08-18T11:31:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@NikoCosmico01](https://discuss.elastic.co/u/NikoCosmico01)
#### Post date: [August 18, 2025, 11:31am UTC](https://discuss.elastic.co/t/closing-connection-netty4httpchannel-error/381108/1 "2025-08-18T11:31:06Z")
Hi,
I have an ELK on-premise setup deployed with docker (x3 nodes, x1 Kibana, 1x fleet-server).
Recently, I decided to generate self-signed certificated to ensure SSL and HTTPS communications. The only certificate signed by a trusted CA is for Kibana, so that I can easily use HTTPS to access to it.
I’m using the following files:
- Self Signed CA
- caBundle.p12
- caCert.pem
- caKey.pem
- Node01 (172.18.0.2)
- es01.p12
- Node02 (172.18.0.3)
- es02.p12
- Node03 (172.18.0.4)
- es03.p12
- Fleet Server (172.18.0.6)
- fleet-server.crt
- fleet-server.key
- siem\_bundle.pem (signed by trusted CA and used for Kibana on 172.18.0.5)
The issue I’m having is the following warning on the Elastic nodes:
`"log.level": "WARN", "message":"caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/172.18.0.2:9200, remoteAddress=/10.3.200.7:38404}", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch[es01][transport_worker][T#14]","log.logger":"org.elasticsearch.http.AbstractHttpServerTransport","elasticsearch.cluster.uuid":"H_BQHL-cSi20kBulsPztBQ","elasticsearch.node.id":"BjLdoaB7SkC9hSJoBcgSdg","elasticsearch.node.name":"es01","elasticsearch.cluster.name":"docker-cluster","error.type":"io.netty.handler.codec.DecoderException","error.message":"javax.net.ssl.SSLHandshakeException: (bad_certificate) Received fatal alert: bad_certificate" [...]`
This is my _elasticsearch.yml_ of node 01 (hostname: es01)
`cluster.name: "docker-cluster"`
`xpack.ml.max_model_memory_limit: 8GB`
`network.host: es01`
`xpack.security.enabled: true`
`xpack.security.http.ssl.enabled: true`
`xpack.security.http.ssl.client_authentication: required`
`xpack.security.http.ssl.keystore.path: certNew/es01.p12`
`xpack.security.http.ssl.truststore.path: certNew/es01.p12`
`xpack.security.transport.ssl.enabled: true`
`xpack.security.transport.ssl.verification_mode: certificate`
`xpack.security.transport.ssl.keystore.path: certNew/es01.p12`
`xpack.security.transport.ssl.truststore.path: certNew/es01.p12`
I checked and the _es01.p12_ CA fingerprint matches with the _caCert.pem._
I also tried to generate the es01 cert specifying the IP address with the following command `./bin/elasticsearch-certutil cert --ca caBundle.p12 –ip 172.18.0.2 –name es01`
without solving this issue.
Can you help me in any way?
Thanks.
---
### Author:  [@NikoCosmico01](https://discuss.elastic.co/u/NikoCosmico01)
#### Post date: [August 28, 2025, 8:50am UTC](https://discuss.elastic.co/t/closing-connection-netty4httpchannel-error/381108/2 "2025-08-28T08:50:57Z")
Nothing?
---
### Author:  [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [August 28, 2025, 12:41pm UTC](https://discuss.elastic.co/t/closing-connection-netty4httpchannel-error/381108/3 "2025-08-28T12:41:03Z")
> [@NikoCosmico01](#):
>
> `remoteAddress=/10.3.200.7:38404 … Received fatal alert: bad_certificate`
The log message just means that the client at that address rejected the server certificate. Elasticsearch doesn’t get to learn why it did that, but a very common reason is that the client is not configured to trust the certificate(s) that ES presents.
To make the warning go away you’ll need to work out what client is making requests from this address and reconfigure it to accept ES’s certificate.