# Do I need to generate a cert? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 14, 2021, 7:30pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773 "2021-10-14T19:30:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Post date:** [October 14, 2021, 7:30pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/1 "2021-10-14T19:30:21Z")
I have successfully configured minimal security in my environment and am now moving on to Basic, so that I can use fleet and SIEM. Version of Elastic I am using is 7.13.4, on a RHEL 8.0 server. I only have 1 Elasticsearch server and am wondering if I need to create a CA or can I by-pass this step in configuring the Basic security? Thank you in advance for your support. ---
**Author:** ![zx8086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zx8086/32/94917_2.png) [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Post date:** [October 14, 2021, 10:52pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/2 "2021-10-14T22:52:08Z")
@MKirby You will need it for Fleet, as well as using API Key Tokens elsewhere in the system. ---
**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Post date:** [October 15, 2021, 4:31pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/3 "2021-10-15T16:31:00Z")
Continuation on the Basic security configuration. I have gone through all the steps detailed in the following article: [Basic Security Configuration](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/security-basic-setup.html) I checked and double checked my code as I entered it in the command line to ensure that no spelling errors or items were missed. Now When I start the Elasticsearch service I am unable to if the keystore and truststore paths are not rem'd out in the Elasticsearch.yml file. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 18, 2021, 1:58am UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/4 "2021-10-18T01:58:10Z")
If you'd like help then you're going to need to provide the details of the errors from your logs. Otherwise we're only going to be guessing at what went wrong. ---
**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Post date:** [October 18, 2021, 12:24pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/5 "2021-10-18T12:24:05Z")
Thank you Tim. When I start the service after enabling the keystore and truststore paths in the Elasticsearch,yml file and then check the Elasticsearch.log file I see alot of informational lines and nothing that is an error. Here are some of the lines that I find interesting. ```auto JVM arguments [-Xshare:auto, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xsslm, -Djava.awt.headkess=true, -Dfile.encoding=UTF-8, Djna.nosys=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI.COMPAT, --add-opens=java.base/java.io=ALL-UNAMED, -XX:+UseGIGC, -Djava.io.tmp/elasticsearch-5125581821760876765, -XX:+HeapDumpOnOutOf MemoryError, -XX:HeapDumpPath=/var/lib/elasticsearch, -XXErrorFile=/var/log/elasticsearch/hs_err_pid%p.log, Xlog:gc* ,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Xms7915m, -XX:MaxDirectMemorySize=4150263808, -XS:GiHeapRegionSize=4m, -XX:InitatingHeapOccupancyPercent=30, --XX:GiReservePercent=15, Des.path.home=/usr/share/elasticsearch, -Des.path.conf=/etc/elasticsearch, -Des.distribution.flavor=default, -Des.distribution.type=rpm, -Des.bundled_jdk=true] [2021-10-18T07:7:57:00,631][INFO][o.e.p.PluginService] [machine_name.localdomain] loaded module ...... ``` I hope that can help to narrow down what is going on. As mentioned there is nothing that comes out and shows an [ERROR] all lines are [INFO] Thanks for your help. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 19, 2021, 1:36am UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/6 "2021-10-19T01:36:45Z")
What makes you think there's a problem? Earlier you said: > [@MKirby](#): > > When I start the Elasticsearch service I am unable to if the keystore and truststore paths are not rem'd out in the Elasticsearch.yml file But you also say: > [@MKirby](#): > > I see alot of informational lines and nothing that is an error. So, what are you seeing that makes you think you have a problem? ---
**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Post date:** [October 19, 2021, 12:01pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/7 "2021-10-19T12:01:42Z")
Well I feel that we have an error or problem because I cannot start the Elasticsearch service when I have the xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 and/or xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 enabled in my Elasticsearch.yml file, Am I mistaken? When I look at the /var/log/Elasticsearch/Elasticsearch.log file it shows that the Basic Security it enabled. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 20, 2021, 3:36am UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/8 "2021-10-20T03:36:43Z")
> [@MKirby](#): > > I cannot start the Elasticsearch service when I have the xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 and/or xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 enabled in my Elasticsearch.yml file, I can't help without more details. If there's nothing in the logs that says there is a problem, how did you determine that you can't start the Elasticsearch service? Do you get an error somewhere? What does that error say? If you're looking for help, then exact details matter. ---
**Author:** ![MKirby](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Post date:** [October 21, 2021, 7:23pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/9 "2021-10-21T19:23:03Z")
To answer your question Tim. I wasn't able to find any errors, all I knew is that when i enabled the Keystore and Truststore certificates and the attempted to start the Elasticsearch service it would time out and not start. I have since kept those two lines disabled in the yml file and carried on with my installation. Everything seems to be working fine at the moment. Thank you for your replies. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 18, 2021, 7:23pm UTC](https://discuss.elastic.co/t/do-i-need-to-generate-a-cert/286773/10 "2021-11-18T19:23:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.