# CURL CONNECT SSL WITH CERTIFICATE OF SHA256 get error **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 3, 2019, 10:05pm UTC](https://discuss.elastic.co/t/curl-connect-ssl-with-certificate-of-sha256-get-error/188816 "2019-07-03T22:05:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![GabayAvi](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@GabayAvi](https://discuss.elastic.co/u/GabayAvi)\ **Post date:** [July 3, 2019, 10:05pm UTC](https://discuss.elastic.co/t/curl-connect-ssl-with-certificate-of-sha256-get-error/188816/1 "2019-07-03T22:05:01Z")
hay i got a new elk server but CA stuff built the certificate with "Signature Algorithm: sha256WithRSAEncryption" when i execute the command : curl -u elastic --cacert /etc/elasticsearch/crt/ca.crt -XGET "[https://devlnxxxxxxx.xxx.local:9200/\_cat/indices?pretty&s=index](https://devlnxxxxxxx.xxx.local:9200/_cat/indices?pretty&s=index)" the response is : curl: (35) SSL received a record that exceeded the maximum permissible length i tried to execute with --cipher and i got time out curl -u elastic --ciphers dhe\_rsa\_aes\_256\_cbc\_sha\_256 --cacert /etc/elasticsearch/crt/ca.crt -XGET "[https://devlnxxxxxxx.xxx.local:9200/\_cat/indices?pretty&s=index](https://devlnxxxxxxx.xxx.local:9200/_cat/indices?pretty&s=index)" curl: (28) Operation timed out after 300426 milliseconds with 0 out of 0 bytes received the output of openssl on this certificate start like this : Certificate: Data: Version: 3 (0x2) Serial Number: 4e:89:2d:29:5b:63:32:ab:41:27:6f:1e:48:f5:48:6b Signature Algorithm: _sha256WithRSAEncryption_ my curl version is curl --version curl 7.29.0 (x86\_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.36 zlib/1.2.7 libidn/1.28 libssh2/1.4.3 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM\_WB SSL libz unix-sockets elasticsearch version is 7.2 how can i run the command with the accurate parameters ? thks alot ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 4, 2019, 2:01am UTC](https://discuss.elastic.co/t/curl-connect-ssl-with-certificate-of-sha256-get-error/188816/2 "2019-07-04T02:01:04Z")
> [@GabayAvi](#): > > curl: (35) SSL received a record that exceeded the maximum permissible length Is your Elasticsearch node really running TLS on the HTTP port? What does your `elasticsearch.yml` look like? ---
**Author:** ![GabayAvi](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@GabayAvi](https://discuss.elastic.co/u/GabayAvi)\ **Post date:** [July 4, 2019, 4:27pm UTC](https://discuss.elastic.co/t/curl-connect-ssl-with-certificate-of-sha256-get-error/188816/3 "2019-07-04T16:27:21Z")
we just replace the cerficate from sha256 to sha1 and its work thnks ---
**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\ **Post date:** [July 5, 2019, 2:29am UTC](https://discuss.elastic.co/t/curl-connect-ssl-with-certificate-of-sha256-get-error/188816/4 "2019-07-05T02:29:00Z")
For anyone reading this in the future, don’t use sha1 certificates. If you have issues with certs and TLS request assistance from your sysadmins or a colleague or here but DO NOT use sha1 certificate. They have been dead and rightly so, for years. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 5, 2019, 4:27am UTC](https://discuss.elastic.co/t/curl-connect-ssl-with-certificate-of-sha256-get-error/188816/5 "2019-07-05T04:27:14Z")
This appears to be a curl problem, not an Elasticsearch problem - your curl version cannot handle modern certificates. You are using curl `7.29` which is [more than 6 years old](https://curl.haxx.se/changes.html#7_29_0). You really should fix that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 2, 2019, 4:27am UTC](https://discuss.elastic.co/t/curl-connect-ssl-with-certificate-of-sha256-get-error/188816/6 "2019-08-02T04:27:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.