# Elastic search TLS certificate setup, handshake failed. unexpected remote node

**URL:** <https://discuss.elastic.co/t/elastic-search-tls-certificate-setup-handshake-failed-unexpected-remote-node/280684>\
**Category:** Elastic Security\
**Tags:** elastic-stack-security, docker\
**Created:** [August 6, 2021, 8:59pm UTC](https://discuss.elastic.co/t/elastic-search-tls-certificate-setup-handshake-failed-unexpected-remote-node/280684 "2021-08-06T20:59:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Syed\_Hami](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syed_hami/32/84391_2.png) [@Syed\_Hami](https://discuss.elastic.co/u/Syed_Hami)\
**Post date:** [August 6, 2021, 8:59pm UTC](https://discuss.elastic.co/t/elastic-search-tls-certificate-setup-handshake-failed-unexpected-remote-node/280684/1 "2021-08-06T20:59:00Z")

</div>

I am getting this issue :  
stacktrace": ["org.elasticsearch.transport.ConnectTransportException: [my-server01][172.17.0.2:9300] handshake failed. unexpected remote node {my-server02}{C5Yp3aubR9ySTOAYm7txiA}{ZvtLxxD3SU6vRrqZM27dQg}{172.17.0.2}{172.17.0.2:9300}{cdfhlmrstw}{ml.machine\_memory=8148025344, ml.max\_open\_jobs=512, xpack.installed=true, ml.max\_jvm\_size=536870912, transform.node=true}",

I don't know this ip 172.17.0.2 coming from i guess from the docker.

elasticsearch.yml  
\<  
cluster.name: elk-server  
node.name: "my-server01"

node.master: true  
node.data: true  
node.ingest: true  
network.host: 0.0.0.0

discovery.seed\_hosts: ["my-server02", "my-server03"]  
cluster.initial\_master\_nodes: ["my-server01", "my-server02", "my-server03"]

#bootstrap.memory\_lock: true

xpack.security.enabled: true  
xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.verification\_mode: certificate  
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/ssl/vie01-elk-server01.p12  
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/ssl/vie01-elk-server01.p12  
xpack.security.http.ssl.enabled: true  
xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/ssl/vie01-elk-server01.p12  
xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/ssl/vie01-elk-server01.p12  
xpack.security.http.ssl.verification\_mode: certificate

/\>`

docker command used:  
\<docker run -d --name $HOSTNAME -p 9200:9200 -p 9300:9300 -e ELASTIC\_PASSWORD=admin#432 -e ES\_JAVA\_OPTS="-Xms512m -Xmx512m" -v /etc/hosts:/etc/hosts -v /home/mgms-admin/.elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml -v /home/mgms-admin/.elasticsearch/data:/usr/share/elasticsearch/data -v /home/mgms-admin/.elasticsearch/certs:/usr/share/elasticsearch/config/ssl [docker.elastic.co/elasticsearch/elasticsearch:7.14.0](http://docker.elastic.co/elasticsearch/elasticsearch:7.14.0) /\>

In the instances.yml  
instances:

- name: "my-server01"  
ip:
  - "x.x.x.x"  
dns:
  - "my-server01.rc.elk"

- name: "my-server02"  
ip:
  - "x.x.x.x"  
dns:
  - "my-server02.rc.elk"

- name: "my-server03"  
ip:
  - "x.x.x.x"  
dns:
  - "my-server03.rc.elk"

This command to create cert:  
bin/elasticsearch-certutil cert --silent --in instances.yml --out test1.zip --keep-ca-key

Unzip test1.zip  
ca - ca.p12  
my-server01 my-server01.p12  
my-server02 my-server02.p12  
my-server03 my-server03.p12

in the browser if i hit [https://ip:9200](https://ip:9200) but not secure, unable to import ca.p12 in the browser asking about password but while issue didn't given passowrd.

![image](https://us1.discourse-cdn.com/elastic/original/3X/4/0/40d83776077e0a2cdcefe83f359ddc116f70c707.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2021, 8:59pm UTC](https://discuss.elastic.co/t/elastic-search-tls-certificate-setup-handshake-failed-unexpected-remote-node/280684/2 "2021-09-03T20:59:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.