# Connect ElasticSearch using username,password and ssl certificate .net

**URL:** <https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, language-clients\
**Created:** [July 20, 2022, 2:03pm UTC](https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162 "2022-07-20T14:03:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lahav.Harary](https://avatars.discourse-cdn.com/v4/letter/l/e0b2c6/32.png) [@Lahav.Harary](https://discuss.elastic.co/u/Lahav.Harary)\
**Post date:** [July 20, 2022, 2:03pm UTC](https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162/1 "2022-07-20T14:03:31Z")

</div>

Hey,  
I'm having a problem connecting Elasticsearch using username,password and p12 certificate.

The certificate was created using the following guide: [Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html)

I have tried:

1. sending the p12 certificate as a base64 string - X509Certificate2 object said that the password is incorrect (the password is correct).
2. converting the p12 to pem and then to base64 - X509Certificate2 was created but sending requests via .net did not work
3. trying to load the file path (didn't work because the p12 file requires a password).

Here is my code:

```auto
X509Certificate2 certificate = new X509Certificate2(
Convert.FromBase64String(certificateString),
certificatePassword, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
            
var pool = new SingleNodeConnectionPool(new Uri("https://localhost:9200"));
var settings = new ConnectionSettings(pool)
.BasicAuthentication(elasticUserName,elasticPassword)
.DefaultIndex(index)
.CertificateFingerprint(elasticCertificateFingerprint)
.ClientCertificate(certificate);
            
_client = new ElasticClient(settings);

```

Here is my elasticsearch.yml file:

```auto
cluster.name : my-cluster
node.name: node-1
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
  client_authentication: required 
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  client_authentication: optional 
  keystore.path: certs/http.p12
cluster.initial_master_nodes: ["ip-10-0-0-13.eu-west-2.compute.internal"]
http.host: 0.0.0.0
xpack.security.transport.ssl.truststore.password: aaaaaa
xpack.security.http.ssl.truststore.password: aaaaaa

```

Here is what Elastic is saying when I use the pem certificate:

[2022-07-20T16:56:35,244][WARN][o.e.h.AbstractHttpServerTransport] [node-1] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/[0:0:0:0:0:0:0:1]:9200, remoteAddress=/[0:0:0:0:0:0:0:1]:52745}  
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chain  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:480) ~[netty-codec-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:279) ~[netty-codec-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:722) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:623) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:586) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:496) [netty-transport-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:986) [netty-common-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.74.Final.jar:4.1.74.Final]  
at java.lang.Thread.run(Thread.java:833) [?:?]  
Caused by: javax.net.ssl.SSLHandshakeException: Empty server certificate chain  
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]  
at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]  
at sun.security.ssl.TransportContext.fatal(TransportContext.java:358) ~[?:?]  
at sun.security.ssl.TransportContext.fatal(TransportContext.java:314) ~[?:?]  
at sun.security.ssl.TransportContext.fatal(TransportContext.java:305) ~[?:?]  
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:390) ~[?:?]  
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:375) ~[?:?]  
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]  
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480) ~[?:?]  
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277) ~[?:?]  
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264) ~[?:?]  
at java.security.AccessController.doPrivileged(AccessController.java:712) ~[?:?]  
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209) ~[?:?]  
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1548) ~[netty-handler-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1394) ~[netty-handler-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1235) ~[netty-handler-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1284) ~[netty-handler-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:510) ~[netty-codec-4.1.74.Final.jar:4.1.74.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:449) ~[netty-codec-4.1.74.Final.jar:4.1.74.Final]  
... 16 more

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [July 21, 2022, 1:09am UTC](https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162/2 "2022-07-21T01:09:47Z")

</div>

There are some oddities in your settings.

> [@Lahav.Harary](#):
>
> ```auto
> xpack.security.http.ssl:
> enabled: true
> keystore.path: certs/http.p12
> client_authentication: required 
> xpack.security.transport.ssl:
> enabled: true
> verification_mode: certificate
> client_authentication: optional 
> keystore.path: certs/http.p12
> 
> ```

For HTTP, are you sure you need `client_authentication: requried`. Most of the time, this is not necessary. If you really need it, most of the time you need configure a trust anchor (with either `truststore.path` or `certificate_authorities`), otherwise the incoming certificate is likely to fail verification.

For Transport, it is highly recommended to enable `client_authentication: required`. On transport layer, mTLS is your only protection for node membership. But to use that, you need configure the trust anchor too, which is [documented](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup.html#encrypt-internode-communication) in the guide.

I am not sure what Java library you are using to connect Elasticsearch. So I cannot comment on that part of code. But I'd highly recommend [ES's official java client](https://github.com/elastic/elasticsearch-java).

---

<div class="post-metadata">

**Author:** ![Lahav.Harary](https://avatars.discourse-cdn.com/v4/letter/l/e0b2c6/32.png) [@Lahav.Harary](https://discuss.elastic.co/u/Lahav.Harary)\
**Post date:** [July 21, 2022, 8:36am UTC](https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162/3 "2022-07-21T08:36:39Z")

</div>

Hey Yang\_Wang,

I Tried changing the yml file and the guide that u posted.

elasticsearch.yml:

```auto
cluster.name : my-cluster
node.name: node-1
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
  enabled: true
  keystore.path: certs/http.p12
  client_authentication: optional 
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  client_authentication: required 
  truststore.path: certs/http.p12
  keystore.path: certs/http.p12
cluster.initial_master_nodes: ["ip-10-0-0-13.eu-west-2.compute.internal"]
http.host: 0.0.0.0
xpack.security.http.ssl.truststore.password: aaaaaa

```

My code can't open the http.p12 certificate for some reason is tell me that the password is incorrect (I Can open it just fine when I use postman).

Please advice regarding that

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [July 22, 2022, 6:36am UTC](https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162/4 "2022-07-22T06:36:27Z")

</div>

> [@Lahav.Harary](#):
>
> My code can't open the http.p12 certificate for some reason is tell me that the password is incorrect (I Can open it just fine when I use postman).

Sorry but I don't know what library you are using for your code. I am also not an expert of arbitrary Java libraries. So I am afraid that I won't be very helpful in this regard.

---

<div class="post-metadata">

**Author:** ![Lahav.Harary](https://avatars.discourse-cdn.com/v4/letter/l/e0b2c6/32.png) [@Lahav.Harary](https://discuss.elastic.co/u/Lahav.Harary)\
**Post date:** [July 24, 2022, 11:04am UTC](https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162/5 "2022-07-24T11:04:08Z")

</div>

Hello again,  
I'm using NEST in C# .NET core

Do you need any more info from me?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2022, 11:04am UTC](https://discuss.elastic.co/t/connect-elasticsearch-using-username-password-and-ssl-certificate-net/310162/6 "2022-08-21T11:04:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.