# Documentation of elasticsearch-certutil is wrong for parameter --pass
**URL:** https://discuss.elastic.co/t/documentation-of-elasticsearch-certutil-is-wrong-for-parameter-pass/155412
**Category:** Elasticsearch
**Created:** [November 5, 2018, 1:59pm UTC](https://discuss.elastic.co/t/documentation-of-elasticsearch-certutil-is-wrong-for-parameter-pass/155412 "2018-11-05T13:59:09Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@muffl0n](https://discuss.elastic.co/u/muffl0n)
#### Post date: [November 5, 2018, 1:59pm UTC](https://discuss.elastic.co/t/documentation-of-elasticsearch-certutil-is-wrong-for-parameter-pass/155412/1 "2018-11-05T13:59:09Z")
The [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html) states that
> If you want to specify a blank password (without prompting), use --pass "" (with no =).
But that seems to be wrong:
```auto
$ /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --silent -in /etc/elasticsearch/instances.yml --out /tmp/elasticsearch-ssl-certs.zip --pass ""
Exception in thread "main" java.lang.IllegalArgumentException: password empty
at org.bouncycastle.jcajce.provider.symmetric.OpenSSLPBKDF$PBKDF.engineGenerateSecret(Unknown Source)
at javax.crypto.SecretKeyFactory.generateSecret(SecretKeyFactory.java:330)
at org.bouncycastle.openssl.jcajce.PEMUtilities.getKey(Unknown Source)
at org.bouncycastle.openssl.jcajce.PEMUtilities.crypt(Unknown Source)
at org.bouncycastle.openssl.jcajce.JcePEMEncryptorBuilder$1.encrypt(Unknown Source)
at org.bouncycastle.openssl.MiscPEMGenerator.createPemObject(Unknown Source)
at org.bouncycastle.openssl.MiscPEMGenerator.generate(Unknown Source)
at org.bouncycastle.util.io.pem.PemWriter.writeObject(Unknown Source)
at org.bouncycastle.openssl.jcajce.JcaPEMWriter.writeObject(Unknown Source)
at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.lambda$generateAndWriteSignedCertificates$0(CertificateTool.java:798)
at org.elasticsearch.xpack.security.cli.CertificateTool.withPassword(CertificateTool.java:936)
at org.elasticsearch.xpack.security.cli.CertificateTool.access$100(CertificateTool.java:85)
at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.lambda$generateAndWriteSignedCertificates$1(CertificateTool.java:797)
at org.elasticsearch.xpack.security.cli.CertificateTool.lambda$fullyWriteZipFile$0(CertificateTool.java:950)
at org.elasticsearch.xpack.security.cli.CertificateTool.fullyWriteFile(CertificateTool.java:994)
at org.elasticsearch.xpack.security.cli.CertificateTool.fullyWriteZipFile(CertificateTool.java:947)
at org.elasticsearch.xpack.security.cli.CertificateTool.access$500(CertificateTool.java:85)
at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.generateAndWriteSignedCertificates(CertificateTool.java:765)
at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.execute(CertificateTool.java:700)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:77)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
at org.elasticsearch.cli.Command.main(Command.java:90)
at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:137)
```
Not specifying the parameter at all works, though:
```auto
$ /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --silent -in /etc/elasticsearch/instances.yml --out /tmp/elasticsearch-ssl-certs.zip
```
Installed version: 6.4.2 ([https://artifacts.elastic.co/packages/6.x/apt](https://artifacts.elastic.co/packages/6.x/apt))
---
### Author:  [@gbrown](https://discuss.elastic.co/u/gbrown)
#### Post date: [November 5, 2018, 10:38pm UTC](https://discuss.elastic.co/t/documentation-of-elasticsearch-certutil-is-wrong-for-parameter-pass/155412/2 "2018-11-05T22:38:59Z")
Thanks for noticing this and reporting it!
Could I ask you to [open an issue on the Elasticsearch repository](https://github.com/elastic/elasticsearch/issues/new) about this? We use GitHub to track bugs (including documentation bugs!) and it's most likely to get fixed if there's an open issue about it.
---
### Author:  [@muffl0n](https://discuss.elastic.co/u/muffl0n)
#### Post date: [November 6, 2018, 7:24am UTC](https://discuss.elastic.co/t/documentation-of-elasticsearch-certutil-is-wrong-for-parameter-pass/155412/3 "2018-11-06T07:24:32Z")
Sure! [https://github.com/elastic/elasticsearch/issues/35285](https://github.com/elastic/elasticsearch/issues/35285)
Thanks for your quick reply! 👍
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 7, 2018, 8:40am UTC](https://discuss.elastic.co/t/documentation-of-elasticsearch-certutil-is-wrong-for-parameter-pass/155412/4 "2018-11-07T08:40:32Z")
The documentation is not very clear, but it's technically correct. (I say that not to be argumentative, just to explain what is happening here).
`--pass ""` does indeed specify a blank password. But PEM files don't support blank passwords, so you get the error that you saw.
Note that a _blank_ password is different than "no password". You can have a PEM file with _no password_ (an unencrypted key) but you cannot have one that is encrypted with the blank password.
That's different for PKCS#12, where you are required to have a password, but it is allowed to be blank.
I'll get the docs updated to be more clear about this, but if you just want a PEM file with no password, don't specify `--pass` at all.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 5, 2018, 8:40am UTC](https://discuss.elastic.co/t/documentation-of-elasticsearch-certutil-is-wrong-for-parameter-pass/155412/5 "2018-12-05T08:40:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.