# Elastic Search Setup in Docker Swarm with xpack.security **URL:** \ **Category:** Elasticsearch\ **Tags:** docker\ **Created:** [January 15, 2025, 3:04pm UTC](https://discuss.elastic.co/t/elastic-search-setup-in-docker-swarm-with-xpack-security/373236 "2025-01-15T15:04:15Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![MarvinObert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marvinobert/32/140689_2.png) [@MarvinObert](https://discuss.elastic.co/u/MarvinObert)\ **Post date:** [January 15, 2025, 3:04pm UTC](https://discuss.elastic.co/t/elastic-search-setup-in-docker-swarm-with-xpack-security/373236/1 "2025-01-15T15:04:15Z")
Hi, I want to create an elastic with kibana and 3 nods. I have my docker compose which I use to setup the config in my docker swarm. On es01 I get the error: Caused by: org.elasticsearch.common.ssl.SslConfigException: cannot read configured PEM certificate\_authorities [/usr/share/elasticsearch/config/certs/ca/ca.crt] because the file does not exist When I use my debug container then there is the ca.crt file in this folder. Here is my compose file. ```auto version: '3.8' services: debug: image: alpine container_name: debug-container entrypoint: sh stdin_open: true tty: true volumes: - certs:/usr/share/elasticsearch/config/certs setup: image: docker.elastic.co/elasticsearch/elasticsearch:8.16.1 volumes: - certs:/usr/share/elasticsearch/config/certs user: "0" command: > bash -c ' if [x${ELASTIC_PASSWORD} == x]; then echo "Set the ELASTIC_PASSWORD environment variable in the .env file"; exit 1; elif [x${KIBANA_PASSWORD} == x]; then echo "Set the KIBANA_PASSWORD environment variable in the .env file"; exit 1; fi; if [! -f config/certs/ca.zip]; then echo "Creating CA"; bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip; unzip config/certs/ca.zip -d config/certs; fi; if [! -f config/certs/certs.zip]; then echo "Creating certs"; echo -ne \ "instances:\n"\c " - name: es01\n"\ " dns:\n"\ " - ${ES_HOST_NAME_PREFIX}01:9209\n"\ " - name: es02\n"\ " dns:\n"\ " - ${ES_HOST_NAME_PREFIX}02:9209\n"\ " - name: es03\n"\ " dns:\n"\ " - ${ES_HOST_NAME_PREFIX}03:9209\n"\ > config/certs/instances.yml; bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key; unzip config/certs/certs.zip -d config/certs; fi; echo "Setting file permissions" chown -R root:root config/certs; find . -type d -exec chmod 750 \{\} \;; find . -type f -exec chmod 640 \{\} \;; echo "Waiting for Elasticsearch availability"; until curl -s --cacert config/certs/ca/ca.crt https://${ES_HOST_NAME_PREFIX}01:9209 | grep -q "missing authentication credentials"; do sleep 30; done; echo "Setting kibana_system password"; until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:somethingsecret" -H "Content-Type: application/json" https://${ES_HOST_NAME_PREFIX}01:9209/_security/user/kibana_system/_password -d "{\"password\":\"somethingsecret\"}" | grep -q "^{}"; do sleep 10; done; echo "All done!"; ' healthcheck: test: ["CMD-SHELL", "[-f config/certs/es01/es01.crt]"] interval: 1s timeout: 5s retries: 30 es01: image: docker.elastic.co/elasticsearch/elasticsearch:8.16.1 environment: - node.name=es01-${STACK_ENV} - cluster.name=es-docker-cluster-updated - discovery.seed_hosts=${ES_HOST_NAME_PREFIX}01,${ES_HOST_NAME_PREFIX}02,${ES_HOST_NAME_PREFIX}03 - cluster.initial_master_nodes=es01-${STACK_ENV},es02-${STACK_ENV},es03-${STACK_ENV} # alle nodes für initiales master voting - muss node.name entsprechen! - bootstrap.memory_lock=true - network.publish_host=${ES_HOST_NAME_PREFIX}01 # explizit angeben sonst wird container adresse genommen - transport.port=9309 - http.port=9209 - ES_JAVA_OPTS=-Xms${JAVA_OPTS_HEAPSIZE} -Xmx${JAVA_OPTS_HEAPSIZE} - xpack.security.enabled=true - xpack.security.http.ssl.enabled=true - xpack.security.http.ssl.key=certs/es01/es01.key - xpack.security.http.ssl.certificate=certs/es01/es01.crt - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.enabled=true - xpack.security.transport.ssl.key=certs/es01/es01.key - xpack.security.transport.ssl.certificate=certs/es01/es01.crt - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.verification_mode=certificate - xpack.license.self_generated.type=basic - ELASTIC_PASSWORD=somethingsecret ulimits: memlock: soft: -1 hard: -1 volumes: - data01:/usr/share/elasticsearch/data - certs:/usr/share/elasticsearch/config/certs ports: - target: 9209 published: 9209 protocol: tcp mode: host - target: 9309 published: 9309 protocol: tcp mode: host networks: - elastic deploy: placement: constraints: - "node.hostname == ${ES_HOST_NAME_PREFIX}01" es02: image: docker.elastic.co/elasticsearch/elasticsearch:8.16.1 environment: - node.name=es02-${STACK_ENV} - cluster.name=es-docker-cluster-updated - discovery.seed_hosts=${ES_HOST_NAME_PREFIX}01,${ES_HOST_NAME_PREFIX}02,${ES_HOST_NAME_PREFIX}03 - cluster.initial_master_nodes=es01-${STACK_ENV},es02-${STACK_ENV},es03-${STACK_ENV} # alle nodes für initiales master voting - muss node.name entsprechen! - bootstrap.memory_lock=true - network.publish_host=${ES_HOST_NAME_PREFIX}02 # explizit angeben sonst wird container adresse genommen - transport.port=9309 - http.port=9209 - ES_JAVA_OPTS=-Xms${JAVA_OPTS_HEAPSIZE} -Xmx${JAVA_OPTS_HEAPSIZE} - xpack.security.enabled=true - xpack.security.http.ssl.enabled=true - xpack.security.http.ssl.key=certs/es02/es02.key - xpack.security.http.ssl.certificate=certs/es02/es02.crt - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.enabled=true - xpack.security.transport.ssl.key=certs/es02/es02.key - xpack.security.transport.ssl.certificate=certs/es02/es02.crt - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.verification_mode=certificate - xpack.license.self_generated.type=basic - ELASTIC_PASSWORD=somethingsecret ulimits: memlock: soft: -1 hard: -1 ports: - target: 9209 published: 9209 protocol: tcp mode: host - target: 9309 published: 9309 protocol: tcp mode: host volumes: - data02:/usr/share/elasticsearch/data - certs:/usr/share/elasticsearch/config/certs networks: - elastic deploy: placement: constraints: - "node.hostname == ${ES_HOST_NAME_PREFIX}02" es03: image: docker.elastic.co/elasticsearch/elasticsearch:8.16.1 environment: - node.name=es03-${STACK_ENV} - cluster.name=es-docker-cluster-updated - discovery.seed_hosts=${ES_HOST_NAME_PREFIX}01,${ES_HOST_NAME_PREFIX}02,${ES_HOST_NAME_PREFIX}03 - cluster.initial_master_nodes=es01-${STACK_ENV},es02-${STACK_ENV},es03-${STACK_ENV} # alle nodes für initiales master voting - muss node.name entsprechen! - bootstrap.memory_lock=true - network.publish_host=${ES_HOST_NAME_PREFIX}03 # explizit angeben sonst wird container adresse genommen - transport.port=9309 - http.port=9209 - ES_JAVA_OPTS=-Xms${JAVA_OPTS_HEAPSIZE} -Xmx${JAVA_OPTS_HEAPSIZE} - xpack.security.enabled=true - xpack.security.http.ssl.enabled=true - xpack.security.http.ssl.key=certs/es03/es03.key - xpack.security.http.ssl.certificate=certs/es03/es03.crt - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.enabled=true - xpack.security.transport.ssl.key=certs/es03/es03.key - xpack.security.transport.ssl.certificate=certs/es03/es03.crt - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt - xpack.security.transport.ssl.verification_mode=certificate - xpack.license.self_generated.type=basic - ELASTIC_PASSWORD=somethingsecret ulimits: memlock: soft: -1 hard: -1 volumes: - data03:/usr/share/elasticsearch/data - certs:/usr/share/elasticsearch/config/certs networks: - elastic ports: - target: 9209 published: 9209 protocol: tcp mode: host - target: 9309 published: 9309 protocol: tcp mode: host deploy: placement: constraints: - "node.hostname == ${ES_HOST_NAME_PREFIX}03" kibana: image: docker.elastic.co/kibana/kibana:8.16.1 volumes: - kibanadata:/usr/share/kibana/data - certs:/usr/share/elasticsearch/config/certs ports: - 5609:5609 environment: ELASTICSEARCH_HOSTS: '["http://${ES_HOST_NAME_PREFIX}01:9209","http://${ES_HOST_NAME_PREFIX}02:9209","http://${ES_HOST_NAME_PREFIX}03:9209"]' SERVER_PORT: 5609 SERVER_PUBLICBASEURL: ${KIBANA_URL} ELASTICSEARCH_USERNAME: elastic ELASTICSEARCH_PASSWORD: somethingsecret deploy: placement: constraints: - "node.hostname == ${ES_HOST_NAME_PREFIX}01" volumes: data01: driver: local data02: driver: local data03: driver: local kibanadata: driver: local certs: driver: local networks: elastic: driver: overlay ``` Thanks for the help. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 21, 2025, 2:42am UTC](https://discuss.elastic.co/t/elastic-search-setup-in-docker-swarm-with-xpack-security/373236/2 "2025-01-21T02:42:59Z")
Your elasticsearch containers ( `es01`,`es02`,`es03`) don't depend on your setup container so they're starting before your certificates are generated. Have a look at the example compose file in the docs - [Install Elasticsearch with Docker | Elasticsearch Guide [8.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#docker-compose-file) The elasticsearch containers in that example include a `depends_on` section. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 18, 2025, 2:43am UTC](https://discuss.elastic.co/t/elastic-search-setup-in-docker-swarm-with-xpack-security/373236/3 "2025-02-18T02:43:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.