# Disabling certificate verification for watcher emails?

**URL:** https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [October 2, 2018, 2:26pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719 "2018-10-02T14:26:46Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![Horaci\_Macias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/horaci_macias/32/46466_2.png) [@Horaci\_Macias](https://discuss.elastic.co/u/Horaci_Macias)
#### Post date: [October 2, 2018, 2:26pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/1 "2018-10-02T14:26:46Z")

</div>

Is there any way to disable SSL certificate validation for emails sent through Watcher?

I'm having trouble integrating with an SMTP server even after adding the certificate and CA certificate to the truststore.  
At least for a test, if I can do something like setting

```auto
mail.smtp.ssl.trust=mysmtpserver.com

```

I can confirm connectivity. Is there any way to pass this property or anything along those lines?

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [October 2, 2018, 2:48pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/2 "2018-10-02T14:48:31Z")

</div>

Hi Horaci,

Unfortunately this is not currently possible via Elasticsearch's configuration. We're tracking progress for this feature request in [this issue](https://github.com/elastic/elasticsearch/issues/30307)

For the time being, the only workaround is to add the CA certificate that has signed your SMTP server's certificate to the trusted CAs of the JVM that Elasticsearch runs in.

---

<div class="post-metadata">

### Author: ![Horaci\_Macias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/horaci_macias/32/46466_2.png) [@Horaci\_Macias](https://discuss.elastic.co/u/Horaci_Macias)
#### Post date: [October 2, 2018, 2:59pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/3 "2018-10-02T14:59:49Z")

</div>

thanks Ioannis for the quick reply.

Looking at [https://github.com/elastic/elasticsearch/blob/1f72afa77314d27208e710398f65f701c865ea1f/x-pack/plugin/watcher/src/main/java/org/elasticsearch/xpack/watcher/notification/email/EmailService.java](https://github.com/elastic/elasticsearch/blob/1f72afa77314d27208e710398f65f701c865ea1f/x-pack/plugin/watcher/src/main/java/org/elasticsearch/xpack/watcher/notification/email/EmailService.java) I noticed

```auto
    private static final Setting.AffixSetting<String> SETTING_SMTP_SSL_TRUST_ADDRESS =
            Setting.affixKeySetting("xpack.notification.email.account.", "smtp.ssl.trust",
                    (key) -> Setting.simpleString(key, Property.Dynamic, Property.NodeScope));

```

and was hoping this would be a potential approach. Are you saying nobody is actually reading that setting when sending the email out?

thanks,

H

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [October 2, 2018, 3:21pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/4 "2018-10-02T15:21:18Z")

</div>

Looks like this change was introduced again ( I was not aware, sorry ), but we're missing the documentation for it and there is an [open issue to address the lack of documentation](https://github.com/elastic/elasticsearch/issues/32936)

Did you actually try it?

---

<div class="post-metadata">

### Author: ![Horaci\_Macias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/horaci_macias/32/46466_2.png) [@Horaci\_Macias](https://discuss.elastic.co/u/Horaci_Macias)
#### Post date: [October 2, 2018, 3:50pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/5 "2018-10-02T15:50:09Z")

</div>

thanks. yes, I tried it but it didn't work; I got the following exception:

```auto
[2018-10-02T15:27:19,905][WARN][o.e.b.ElasticsearchUncaughtExceptionHandler] [
ode_name][] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown setting [mail.smtp.ssl.trust] please check that any required plugins are installed, or check the breaking changes documentation for removed settings
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.4.0.jar:6.4.0]
        at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.4.0.jar:6.4.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.4.0.jar:6.4.0]
Caused by: java.lang.IllegalArgumentException: unknown setting [mail.smtp.ssl.trust] please check that any required plugins are installed, or check the breaking changes documentation for removed settings
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:393) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:339) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:311) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:282) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.common.settings.SettingsModule.<init>(SettingsModule.java:135) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.node.Node.<init>(Node.java:343) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.node.Node.<init>(Node.java:256) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:213) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.4.0.jar:6.4.0]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.4.0.jar:6.4.0]

```

**however** I'm still testing as on another environment the same setup (I'm using the same docker image) doesn't seem to complain about such an _invalid_ config (trouble is on this other environment I don't have access to the smtp server causing me trouble).

Is there any setting to disable elasticsearch configuration validation so I can test on the environment with access to the smtp server using the invalid certificate?  
can you think of any reason why apparently the same setup would throw such exception on one environment and not the other?

thanks again,

H

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [October 3, 2018, 7:56am UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/6 "2018-10-03T07:56:23Z")

</div>

The config option [reintroduced in 6.3.2](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/release-notes-6.3.2.html#bug-6.3.2) should be:

```auto
xpack.notification.email.account.smtp.ssl.trust

```

in the same manner as you'd set any other [watcher email notification settings](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/notification-settings.html#email-notification-settings).

> [@Horaci\_Macias](#):
>
> Is there any setting to disable elasticsearch configuration validation so I can test on the environment with access to the smtp server using the invalid certificate?

No, not really.

> [@Horaci\_Macias](#):
>
> can you think of any reason why apparently the same setup would throw such exception on one environment and not the other?

No, again, not really. I'd check if the config keys are the same and if the extra config key is indeed added to the configuration file. Are both environments using the same Elasticsearch version?

---

<div class="post-metadata">

### Author: ![Horaci\_Macias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/horaci_macias/32/46466_2.png) [@Horaci\_Macias](https://discuss.elastic.co/u/Horaci_Macias)
#### Post date: [October 3, 2018, 8:58am UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/7 "2018-10-03T08:58:37Z")

</div>

thanks Ioannis, I have a bit more information now.

The difference between the working/failing environment was not the elasticsearch.yml file but an **environment property**.  
As soon as I have an environment property with name "mail.smtp.ssl.trust", elastic won't start.  
At least now I have elastic up and running again. Sorry for the confusion before.

Regarding the config option reintroduced, can you please clarify where should this be setup?  
At the email account level in elasticsearch.yml?  
Would this be the correct way? I'm using environment properties for all values.

```auto
xpack.notification.email.account:
    myaccount:
        email_defaults:
            from: ${ES_FROM_EMAIL}
        smtp:
          auth: ${ES_SMTP_AUTH}
          starttls.enable: ${ES_SMTP_STARTTLSENABLE}
          starttls.required: ${ES_SMTP_STARTTLSREQUIRED}
          host: ${ES_SMTP_HOST}
          port: ${ES_SMTP_PORT}
          user: ${ES_SMTP_USER}
          ssl.trust: ${ES_SMTP_HOST}
          password: ${ES_SMTP_PASSWORD}

```

thanks,

H

---

<div class="post-metadata">

### Author: ![Horaci\_Macias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/horaci_macias/32/46466_2.png) [@Horaci\_Macias](https://discuss.elastic.co/u/Horaci_Macias)
#### Post date: [October 3, 2018, 10:50am UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/8 "2018-10-03T10:50:24Z")

</div>

answering my own question, I can confirm the format above works for me and I was able to successfully get an email sent through that smtp server.

thanks again Ioannis for your support!

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [October 3, 2018, 4:06pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/9 "2018-10-03T16:06:10Z")

</div>

You're most welcome. FYI, I opened [https://github.com/elastic/elasticsearch/pull/34275](https://github.com/elastic/elasticsearch/pull/34275) to fix the missing documentation

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 31, 2018, 4:06pm UTC](https://discuss.elastic.co/t/disabling-certificate-verification-for-watcher-emails/150719/10 "2018-10-31T16:06:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
