# Curl: (60) SSL certificate problem: self signed certificate in certificate chain **URL:** \ **Category:** Elasticsearch\ **Tags:** docker\ **Created:** [November 19, 2023, 11:40am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472 "2023-11-19T11:40:49Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [November 19, 2023, 11:40am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/1 "2023-11-19T11:40:49Z")
curl --cacert certs/ca/ca.crt -u elastic:"xyz" 'url' iam getting the below error while trying to execute the above curl command curl: (60) SSL certificate problem: self signed certificate in certificate chain but the curl command does give an output with -k flag even if i try to access elastics serach from browser ip: iam getting an empty reply from server error can anyone please help ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 19, 2023, 10:03pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/2 "2023-11-19T22:03:36Z")
Add the `-v` switch with your curl it will a provide more debugging information. What version of Elastic and what OS are you on? Assume your are using `https` had to tell when you don't share ---
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [November 20, 2023, 2:42am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/3 "2023-11-20T02:42:51Z")
hi stephenb, yes iam using https , Elastic version 8.11.1 and it is linux OS i have deployed it in a kubernetes cluster as a pod both Elasticsearch and kibana when i try with the -v switch iam getting this ```auto method= https ip:10.233.29.65 * Rebuilt URL to: method://ip:9200/ * Uses proxy env variable no_proxy == '127.0.0.1,localhost,169.254.169.254' * Trying 10.233.29.65... * TCP_NODELAY set * Connected to 10.233.29.65 (10.233.29.65) port 9200 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: certs/instance/instance.crt CApath: none * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, [no content] (0): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (OUT), TLS alert, unknown CA (560): * SSL certificate problem: self signed certificate in certificate chain * Closing connection 0 curl: (60) SSL certificate problem: self signed certificate in certificate chain ``` iam also getting an empty server response when i try it from the browse ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 20, 2023, 3:23am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/4 "2023-11-20T03:23:43Z")
@Dasara_Saarthak forgot to say welcome to the community > [@Dasara\_Saarthak](#): > > CAfile: certs/instance/instance.crt > CApath: none Try using the full path to the CA cert not relative in the curl also make sure the file has correct/ read permission. Plus please always show the command + the entire result otherwise it is only half the information. `certs/instance/instance.crt` That does not look like the CA Also looks like perhaps you have a proxy involve ---
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [November 20, 2023, 9:38am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/5 "2023-11-20T09:38:17Z")
Thanks for welcoming me @stephenb , below is the full command i've used ,the instance.crt i have included it here by mistake the original command i've used is method=https [root@sindhuoneexternalelastic-k8sc-node1-1 ~]# curl -v --cacert ~/certs/ca/ca.crt --key certs/ca/ca.key -u elastic:"password" 'method:ip:9200' - Rebuilt URL to: method://ip:9200/ - Trying 10.233.29.65... - TCP\_NODELAY set - Connected to 10.233.29.65 (10.233.29.65) port 9200 (#0) - ALPN, offering h2 - ALPN, offering http/1.1 - successfully set certificate verify locations: - CAfile: ~/certs/ca/ca.crt CApath: none - TLSv1.3 (OUT), TLS handshake, Client hello (1): - TLSv1.3 (IN), TLS handshake, Server hello (2): - TLSv1.3 (IN), TLS handshake, [no content] (0): - TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): - TLSv1.3 (IN), TLS handshake, Certificate (11): - TLSv1.3 (OUT), TLS alert, unknown CA (560): - SSL certificate problem: self signed certificate in certificate chain - Closing connection 0 curl: (60) SSL certificate problem: self signed certificate in certificate chain curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. i have no proxy enabled but still i've delete the no\_proxy env variable also which was there in my previous reply i have also provide the entire path this time ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 20, 2023, 2:48pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/6 "2023-11-20T14:48:46Z")
> [@Dasara\_Saarthak](#): > > ~/certs/ca/ca.crt As I suggested please try full path not relative also did you check permissions on that file `chmod 644 ca.crt` Are you running that command from the command line or inside something like postman? Also, can you run the `-v -k` on the same command sometimes we get more information that way it will go through and will still get more verbose information. Try the full path not relative ---
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [November 21, 2023, 11:51am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/7 "2023-11-21T11:51:57Z")
iam executing it from command line and if i do it from browser i get empty response error this is what i got with using -v -k flags in curl [root@sindhuoneexternalelastic-k8sc-node1-1 ~]# curl -v -k --cacert /root/certs/ca/ca.crt --key /root/certs/ca/ca.key -u elastic:"password" 'method://ip:9200' - Rebuilt URL to: method://ip:9200/ - Trying 10.233.29.65... - TCP\_NODELAY set - Connected to 10.233.29.65 (10.233.29.65) port 9200 (#0) - ALPN, offering h2 - ALPN, offering http/1.1 - successfully set certificate verify locations: - CAfile: /root/certs/ca/ca.crt CApath: none - TLSv1.3 (OUT), TLS handshake, Client hello (1): - TLSv1.3 (IN), TLS handshake, Server hello (2): - TLSv1.3 (IN), TLS handshake, [no content] (0): - TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): - TLSv1.3 (IN), TLS handshake, Certificate (11): - TLSv1.3 (IN), TLS handshake, CERT verify (15): - TLSv1.3 (IN), TLS handshake, Finished (20): - TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): - TLSv1.3 (OUT), TLS handshake, [no content] (0): - TLSv1.3 (OUT), TLS handshake, Finished (20): - SSL connection using TLSv1.3 / TLS\_AES\_256\_GCM\_SHA384 - ALPN, server did not agree to a protocol - Server certificate: - subject: CN=elasticsearch-7976c79b6f-4bdcf - start date: Nov 18 21:01:39 2023 GMT - expire date: Nov 17 21:01:39 2025 GMT - issuer: CN=Elasticsearch security auto-configuration HTTP CA - SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway. - Server auth using Basic with user 'elastic' - TLSv1.3 (OUT), TLS app data, [no content] (0): > GET / HTTP/1.1 > Host: 10.233.29.65:9200 > Authorization: Basic ZWxhc3RpYzpuSjNVdWFFOHAyWjFRSTNVb2xVRA== > User-Agent: curl/7.61.1 > Accept: _/_ - TLSv1.3 (IN), TLS handshake, [no content] (0): - TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): - TLSv1.3 (IN), TLS app data, [no content] (0): \< HTTP/1.1 200 OK \< X-elastic-product: Elasticsearch \< content-type: application/json \< content-length: 558 \< { "name" : "elasticsearch-7976c79b6f-4bdcf", "cluster\_name" : "docker-cluster", "cluster\_uuid" : "B5eVPNLdT0-h9F0Y\_yDs2A", "version" : { "number" : "8.11.1", "build\_flavor" : "default", "build\_type" : "docker", "build\_hash" : "6f9ff581fbcde658e6f69d6ce03050f060d1fd0c", "build\_date" : "2023-11-11T10:05:59.421038163Z", "build\_snapshot" : false, "lucene\_version" : "9.8.0", "minimum\_wire\_compatibility\_version" : "7.17.0", "minimum\_index\_compatibility\_version" : "7.0.0" }, "tagline" : "You Know, for Search" } ---
**Author:** ![raymond74](https://avatars.discourse-cdn.com/v4/letter/r/58f4c7/32.png) [@raymond74](https://discuss.elastic.co/u/raymond74)\ **Post date:** [November 21, 2023, 12:54pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/8 "2023-11-21T12:54:45Z")
> [@Dasara\_Saarthak](#): > > self signed certificate in certificate chain (19) Is the server also sending the root CA in the reply? This is by definition self-signed. It only needs to send the server cert. You might get an error 20 as it might not be trusted. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 21, 2023, 2:36pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/9 "2023-11-21T14:36:43Z")
Can you show exactly how you created the elasticsearch, certificates and your elasticsearch.yml ---
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [November 22, 2023, 5:49am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/10 "2023-11-22T05:49:46Z")
i have pulled the docker image and deployed it as a pod using following yaml file deployment.yml apiVersion: apps/v1 kind: Deployment metadata: name: elasticsearch spec: replicas: 1 selector: matchLabels: app: elasticsearch template: metadata: labels: app: elasticsearch spec: securityContext: runAsUser: 1000 containers: - name: nspos-elasticsearch image: [docker.elastic.co/elasticsearch/elasticsearch:8.11.1](http://docker.elastic.co/elasticsearch/elasticsearch:8.11.1) ports: - containerPort: 9200 resources: requests: cpu: 100m memory: 1Gi limits: cpu: 12 * * * apiVersion: v1 kind: Service metadata: name: elasticsearch-service spec: selector: app: elasticsearch ports: - name: http protocol: TCP port: 9200 targetPort: 9200 - name: transport protocol: TCP port: 9300 targetPort: 9300 after it got deployed i execed into the pod and used the ./elasticsearch-certutil ca --pem to generate ca.crt and ca.key then used ./elasticsearch-certutil cert --ca-cert ca.crt --ca-ke ca.key --pem to generate the cert and get i signed by ca this generated instance.crt and instance.key now i edited the yaml file include them, this is my elasticsearch.yml file in /usr/share/elasticsearch/config/ cluster.name: "docker-cluster" network.host: 0.0.0.0 #----------------------- BEGIN SECURITY AUTO CONFIGURATION ----------------------- # # The following settings, TLS certificates, and keys have been automatically # generated to configure Elasticsearch security features on 18-11-2023 21:01:33 # # -------------------------------------------------------------------------------- # Enable security features xpack.security.enabled: false xpack.security.enrollment.enabled: true # Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents xpack.security.http.ssl: enabled: true certificate: /usr/share/elasticsearch/config/certs/all-certs/instance/instance.crt key: /usr/share/elasticsearch/config/certs/all-certs/instance/instance.key certificate\_authorities: /usr/share/elasticsearch/config/certs/all-certs/ca/ca.crt # Enable encryption and mutual authentication between cluster nodes xpack.security.transport.ssl: enabled: true verification\_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12 # Create a new cluster with the current node only # Additional nodes can still join the cluster later ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 22, 2023, 6:06am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/11 "2023-11-22T06:06:17Z")
To me it looks like you are not generating the http certs correctly you are using `cert` mode you should be using `http` mode See here for http mode > **[elasticsearch-certutil | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html#certutil-http)** > **[Set up basic security for the Elastic Stack plus secured HTTPS traffic |...](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html#encrypt-http-communication)** You can follow the directions > **[Manually configure security | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/manually-configure-security.html)** ---
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [November 28, 2023, 5:18am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/12 "2023-11-28T05:18:26Z")
ok but the file already there in the /usr/share/elasticsearch/config/certs/http\_ca.crt should work if i give this command right? curl -v --cacert http\_ca.crt -u elastic:a\_fmYLwO5dPe-mTYwAgq method://ip:port ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 28, 2023, 8:16am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/13 "2023-11-28T08:16:19Z")
> [@Dasara\_Saarthak](#): > > ./elasticsearch-certutil ca --pem to generate ca.crt and ca.key > then used My point is **that** is the wrong command .. it does not generate the correct http certs and then you are using them in the elasticsearch config... So the HTTP endpoint is not using the correct type of cert. So the correct cert is never presented via http endpoint ---
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [December 7, 2023, 8:11am UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/14 "2023-12-07T08:11:33Z")
hi stephen b i am using elasticsearch helm chart and raised a separate ticket regarding the certificate issue can we move our discussion there? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2023, 3:44pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/15 "2023-12-07T15:44:41Z")
I do not know how to merge the topics... I would just link to the or just copy the relevant information. Also did you understand my previous post? you are not running the correct command to create the `http` certs ---
**Author:** ![Dasara\_Saarthak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dasara_saarthak/32/125976_2.png) [@Dasara\_Saarthak](https://discuss.elastic.co/u/Dasara_Saarthak)\ **Post date:** [December 7, 2023, 4:21pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/16 "2023-12-07T16:21:28Z")
yes i did understand your previous comment in order to run the command i should restart elasticsearch right so in pure docker based deployment if i do that the entire changes are lost so i moved to helm based installation we can just link to the other ticket and discuss there ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2023, 4:33pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/17 "2023-12-07T16:33:42Z")
You can do that... I do not know what other Topic you are talking about. You can just paste a link here yourself... we are not so formal... this is just a community forum 🙂 ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 7, 2023, 4:36pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/18 "2023-12-07T16:36:58Z")
> [@Dasara\_Saarthak](#): > > in order to run the command i should restart elasticsearch right so in pure docker based deployment if i do that the entire changes are los Actually, that is not correct with mounted volumes data can be persisted... Did you look at: [Start a multi-node cluster with Docker Compose](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#docker-compose-file) It does everything sets up everything... Also if you are going to use K8s,, I would use the [ECK](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html) Operator and look at this repo > **[GitHub - sunileman/ElasticKonductor: 1Click Automation of Elastic Cloud on...](https://github.com/sunileman/ElasticKonductor)** > > 1Click Automation of Elastic Cloud on Kubernetes. Contribute to sunileman/ElasticKonductor development by creating an account on GitHub. Honestly I think you should get all your information / questions together and open a new Topic... With a good Subject.. This topic is Old, Only Talks to Curl and probably no one is going to look at it except me. it all depends on what you are actually trying to accomplish... which is unclear to me... That is just my suggestion. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2024, 4:37pm UTC](https://discuss.elastic.co/t/curl-60-ssl-certificate-problem-self-signed-certificate-in-certificate-chain/347472/19 "2024-01-04T16:37:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.