# Elastic 6.1 Internode communication error: SSL handshake exception **URL:** \ **Category:** Elasticsearch\ **Created:** [February 28, 2018, 5:48pm UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910 "2018-02-28T17:48:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Aby](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aby](https://discuss.elastic.co/u/Aby)\ **Post date:** [February 28, 2018, 5:48pm UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910/1 "2018-02-28T17:48:49Z")
I have a 3 node cluster with 1 master and 2 data nodes. SSL/TSL has been setup by getting organization signed certificate. When i seperate the nodes within the cluster by assigning different cluster names and starting the elastic search. ES runs fine. **_Elasticsearch.yml file:_** xpack.security.enabled: true xpack.security.audit.enabled: true xpack: security: authc: realms: ldap3: type: ldap url: "**" bind\_dn: "**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*" bind\_password: sdf user\_search: base\_dn: "DC=\*\*\*\*,DC=net" attribute: CN xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate #xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/bin/x-pack/elastic-certificates.p12 #xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/bin/x-pack/elastic-certificates.p12 xpack.ssl.key: /usr/share/elasticsearch/bin/x-pack/certificate.demo.key xpack.ssl.certificate: /usr/share/elasticsearch/bin/x-pack/certificate.crt xpack.ssl.certificate\_authorities: ["/usr/share/elasticsearch/bin/x-pack/certificate\_ca.crt"] xpack.security.http.ssl.enabled: true But when i rejoin the nodes with the same cluster name i get the attached ![error](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6bbd2e4e805c4f0f579f7e9fd6c56eaed42e1a51.png)error: ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 28, 2018, 6:39pm UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910/2 "2018-02-28T18:39:58Z")
Please make the effort to format your post to be as readable as possible - in particular, please provide log files as text, formatted as a code block (the `` button), rather than images. Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow content that is locked up in images. If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible. Thanks. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 28, 2018, 6:41pm UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910/3 "2018-02-28T18:41:54Z")
It looks like that CA does not provide the correct trust path for the certificate you are using. How did you obtain that CA? ---
**Author:** ![Aby](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aby](https://discuss.elastic.co/u/Aby)\ **Post date:** [March 2, 2018, 10:17am UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910/4 "2018-03-02T10:17:26Z")
Thanks I took a note..I believe it recommended the exceeding characters to be cut short. Ok, to answer you question, I used OpenSSL to generate a CSR with a key. Passed on the CSR file to my trusted certificate admin who then created a CA. i manually then converted the .cer file provided to .crt format and used it to set up the SSL/TLS config in elasticsearch.yml file. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 3, 2018, 7:31pm UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910/5 "2018-03-03T19:31:09Z")
> [@Aby](#): > > Passed on the CSR file to my trusted certificate admin who then created a CA. It may just be an issue with terminology, but that doesn't quite make sense. The "CA" is the certficate for your trusted certicate admin they shouldn't be creating a new one for you. What you need is for the `certificate_ca.crt` to be the CA that generated+signed your `certificate.crt` file. It doesn't look like that is the case here (based on the error message). ---
**Author:** ![Aby](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aby](https://discuss.elastic.co/u/Aby)\ **Post date:** [March 5, 2018, 10:01am UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910/6 "2018-03-05T10:01:52Z")
Apologies my statement was incorrect!!! Yes you are right. certificate\_ca.crt is the CA that was used to generate and sign the certificate.crt. CSR file was generated from my end for each node and sent to the trusted admin who used the certificate\_CA.crt to sign and generate certificate.crt. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 2, 2018, 10:02am UTC](https://discuss.elastic.co/t/elastic-6-1-internode-communication-error-ssl-handshake-exception/121910/7 "2018-04-02T10:02:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.