# Elastic ssl certificate api

**URL:** <https://discuss.elastic.co/t/elastic-ssl-certificate-api/159779>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [December 6, 2018, 5:54pm UTC](https://discuss.elastic.co/t/elastic-ssl-certificate-api/159779 "2018-12-06T17:54:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![misomij](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/misomij/32/10700_2.png) [@misomij](https://discuss.elastic.co/u/misomij)\
**Post date:** [December 6, 2018, 5:54pm UTC](https://discuss.elastic.co/t/elastic-ssl-certificate-api/159779/1 "2018-12-06T17:54:30Z")

</div>

Hi all,

I'm on 6.3.2, trying to configure SSL.  
I used `certutil` to create the keystores for ca and nodes.  
Trying the certificate api I get this information from my node:

```
[
  {
    "path": "/etc/elasticsearch/certs/m2-391-certificates.p12",
    "format": "PKCS12",
    "alias": "instance",
    "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA",
    "serial_number": "xxxxxx",
    "has_private_key": false,
    "expiry": "2021-11-28T14:06:58.000Z"
  },
  {
    "path": "/etc/elasticsearch/certs/m2-391-certificates.p12",
    "format": "PKCS12",
    "alias": "instance",
    "subject_dn": "CN=instance",
    "serial_number": "yyyyyy",
    "has_private_key": true,
    "expiry": "2021-11-28T14:12:08.000Z"
  },
  {
    "path": "/etc/elasticsearch/certs/m2-391-certificates.p12",
    "format": "PKCS12",
    "alias": "ca",
    "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA",
    "serial_number": "xxxxxx",
    "has_private_key": false,
    "expiry": "2021-11-28T14:06:58.000Z"
  }
]

```

while using `keytool` I get this information

```
[root@v-aps-s-m2-391 certs]# keytool -list -keystore /etc/elasticsearch/certs/m2-391-certificates.p12 -v
Enter keystore password:

*****************WARNING WARNING WARNING*****************
* The integrity of the information stored in your keystore *
* has NOT been verified! In order to verify its integrity, *
* you must provide your keystore password. *
*****************WARNING WARNING WARNING*****************

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: instance
Creation date: Nov 29, 2018
Entry type: PrivateKeyEntry

*******************************************
 *******************************************

```

I want to export the certificate but in the keystore i found only the private key, also if I try to export it I get an error:

```
[root@v-aps-s-m2-391 certs]# keytool -export -keystore /etc/elasticsearch/certs/m2-391-certificates.p12 -alias instance -file test

Enter keystore password:

*****************WARNING WARNING WARNING*****************
* The integrity of the information stored in your keystore *
* has NOT been verified! In order to verify its integrity, *
* you must provide your keystore password. *
*****************WARNING WARNING WARNING*****************

keytool error: java.lang.Exception: Alias <instance> has no certificate

```

So where is the certificate stored and how can I access it?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [December 7, 2018, 9:37am UTC](https://discuss.elastic.co/t/elastic-ssl-certificate-api/159779/2 "2018-12-07T09:37:16Z")

</div>

> [@misomij](#):
>
> I used `certutil` to create the keystores for ca and nodes.

Can you share the commands you used?

Can you share which keytool version you are using? You can figure out for instance with

```auto
which keytool | xargs namei

```

Now, you can try to do the same with `openssl` :

- `openssl pkcs12 -in /etc/elasticsearch/certs/m2-391-certificates.p12 -info` will show you the keys and certificates in the `PKCS#12` store.

- `openssl pkcs12 -in elastic-certificates.p12 -clcerts -nokeys -out instance.crt` will output the instance certificate, PEM encoded in the file `instance.crt`

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [December 10, 2018, 5:13am UTC](https://discuss.elastic.co/t/elastic-ssl-certificate-api/159779/3 "2018-12-10T05:13:05Z")

</div>

> [@misomij](#):
>
> keytool error: java.lang.Exception: Alias \<instance\> has no certificate

`keytool` has a lot of really strange behaviours. You're running into a few of them:

1. It assume that if you just press `<enter>` at the `Enter keystore password:` prompt, then you are choosing not to enter a password. It doesn't accept that your keystore might actually have a blank password. (Which I assume is the case for you).
2. It will happily attempt to do things without the password, even though they're not possible
3. It then gives you a completely ridiculous error message when it fails to do them.

If your PKCS#12 file has a blank password, then you need to provide `-storepass ""` to keytool - Keytool will do the wrong thing if you press enter at the password prompt.

```auto
keytool -list -keystore /etc/elasticsearch/certs/m2-391-certificates.p12 -v -storepass ""

```

```auto
keytool -export -keystore /etc/elasticsearch/certs/m2-391-certificates.p12 -alias instance -file test -storepass ""

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 7, 2019, 5:13am UTC](https://discuss.elastic.co/t/elastic-ssl-certificate-api/159779/4 "2019-01-07T05:13:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.