# ECDSA TLS Key Support **URL:** \ **Category:** Elasticsearch\ **Created:** [April 3, 2017, 7:12am UTC](https://discuss.elastic.co/t/ecdsa-tls-key-support/80953 "2017-04-03T07:12:51Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![David\_Lam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_lam/32/134122_2.png) [@David\_Lam](https://discuss.elastic.co/u/David_Lam)\ **Post date:** [April 3, 2017, 7:12am UTC](https://discuss.elastic.co/t/ecdsa-tls-key-support/80953/1 "2017-04-03T07:12:51Z")
We are trying to enable TLS on Elasticsearch using a self-signed EC based CA with EC based keys. That being said, when we tried to supply these to ES it throws up with the following error: Caused by: java.security.NoSuchAlgorithmException: ECDSA KeyFactory not available at java.security.KeyFactory.(KeyFactory.java:138) ~[?:1.8.0\_121] at java.security.KeyFactory.getInstance(KeyFactory.java:172) ~[?:1.8.0\_121] at org.bouncycastle.jcajce.util.DefaultJcaJceHelper.createKeyFactory(Unknown Source) ~[?:?] at org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter.getKeyFactory(Unknown Source) ~[?:?] at org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter.getPrivateKey(Unknown Source) ~[?:?] at org.elasticsearch.xpack.ssl.CertUtils.readPrivateKey(CertUtils.java:272) ~[?:?] ... It looks like ES 5.3.0 (or rather X-Pack 5.3.0) does not support reading in of EC keys yet, but only support ECC only as a cipher selection. Logstash on the other hand, doesn't seem to have this issue when ingesting EC keys. The main use case is to open a port on the Internet so Filebeat can send traffic directly via ES Ingest. I was thinking perhaps I would do a socat proxy if Filebeat does not have the same EC limitation, but haven't really gotten to test this yet. Can someone please shed some light on this? Thanks! ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [April 10, 2017, 6:39pm UTC](https://discuss.elastic.co/t/ecdsa-tls-key-support/80953/2 "2017-04-10T18:39:48Z")
Well, ES doesn't support ECDSA keys due to the fact that JVM does not have a provider for them. [http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyFactory](http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#KeyFactory) And Logstash makes use of JRuby which adds support for them. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [April 13, 2017, 4:53pm UTC](https://discuss.elastic.co/t/ecdsa-tls-key-support/80953/3 "2017-04-13T16:53:58Z")
We're looking into making ECDSA support work when using PEM files. One workaround for the time being might be to use a [Java KeyStore](https://www.elastic.co/guide/en/x-pack/current/security-settings.html#_java_keystore_files) instead of the PEM files. The method for putting your key and certificate(s) into a keystore isn't the most user friendly. The first step is to use a tool like openssl to create a pkcs12 keystore from the key, certificate, and ca certificate. Then you use keytool to import the pkcs12 keystore into a java keystore file (jks). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 11, 2017, 5:03pm UTC](https://discuss.elastic.co/t/ecdsa-tls-key-support/80953/4 "2017-05-11T17:03:19Z")
Closed on May 11, 2017, 5:03pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.