# Elasticsear 8.X TLS question **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 12, 2022, 1:29pm UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521 "2022-03-12T13:29:58Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![qq350162199](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qq350162199/32/83187_2.png) [@qq350162199](https://discuss.elastic.co/u/qq350162199)\ **Post date:** [March 12, 2022, 1:29pm UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/1 "2022-03-12T13:29:58Z")
I'm a beginner, and the latest release of elastic 8.x is a great product that automatically configures TLS security, solves previous complex deployments, and is perfect for a little white like me. But I'm also having problems. 1, automatically created TLS certificate, feel that there is a password, when I try to export the certificate, the promotion needs to enter the password, I directly enter the car is a failure. keytool -importcert -trustcacerts -noprompt -keystore transport.p12 -alias new-ca -file ca.crt Enter keystore password: Keystore password is too short - must be at least 6 characters Enter keystore password: Keystore password is too short - must be at least 6 characters Enter keystore password: Keystore password is too short - must be at least 6 characters Too many failures - try later 1. I deployed and tested two separate sets of elastic 8.x and wanted to test the Remote clusters, but it failed, and I guess it may be the cause of the certificate. How can I add the other person's certificate in the local trust list. log: ELK01.log:[2022-03-12T04:06:32,623][WARN][o.e.c.s.DiagnosticTrustManager] [elk01] failed to establish trust with server at []; the server provided a certificate wit h subject name [CN=elk02], fingerprint [c8cd6bdb7972a9e2b43b51972899b77d3680123d], no keyUsage and no extendedKeyUsage; the session uses cipher suite [TLS\_AES\_256\_GCM\_SHA384] and protocol [TLSv1.3]; the certificate does not have any subject alternative names; the certificate is issued by [CN=Elasticsearch security auto-configuration HTTP CA]; the certifica te is signed by (subject [CN=Elasticsearch security auto-configuration HTTP CA] fingerprint [946aca8e39a5688b866022bc870e650f8f97036b]) which is self-issued; the [CN=Elasticsearch security auto-configuration HTTP CA] certificate is not trusted in this ssl context ([xpack.security.transport.ssl (with trust configuration: StoreTrustConfig{path=certs/transpor t.p12, password=, type=PKCS12, algorithm=PKIX})]); this ssl context does trust a certificate with subject [CN=Elasticsearch security auto-configuration HTTP CA] but the trusted certificate has fingerprint [f6e2abf68a4d7c5d7def6b45104bd1eb8257c774] ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 14, 2022, 12:40am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/2 "2022-03-14T00:40:51Z")
> [@qq350162199](#): > > 1, automatically created TLS certificate, feel that there is a password, when I try to export the certificate, the promotion needs to enter the password, I directly enter the car is a failure. > > keytool -importcert -trustcacerts -noprompt -keystore transport.p12 -alias new-ca -file ca.crt What are you trying to achieve here? Your comment says you want to _export the certificate_ but the command you're running is `-importcert`. We can help you sort it out, but I'm a bit confused about the problem you're trying to solve. ---
**Author:** ![qq350162199](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qq350162199/32/83187_2.png) [@qq350162199](https://discuss.elastic.co/u/qq350162199)\ **Post date:** [March 15, 2022, 3:13am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/3 "2022-03-15T03:13:40Z")
Haha, sorry my technique is as bad as my English. 1、I thought I could add additional CA certificates with this command. [Update security certificates with a different CA | Elasticsearch Guide [8.1] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/update-node-certs-different.html) 2、My main goal is to implement remote search for two elastic 8.x clusters （auto TLS config）. I don't know if there is an easy way to implement it. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 15, 2022, 5:11am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/4 "2022-03-15T05:11:01Z")
OK, configuring for cross cluster search is a step beyond what auto-configuration can do for you, so it makes sense that you're trying to add another CA to the transport truststore. The password for `transport.p12` is stored in the `elasticsearch.keystore` and can get obtained by calling: ```auto elaticsearch-keystore show xpack.security.transport.ssl.truststore.secure_password ``` (you may need to call `bin/elaticsearch-keystore` depending on how your PATH is setup). ---
**Author:** ![qq350162199](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qq350162199/32/83187_2.png) [@qq350162199](https://discuss.elastic.co/u/qq350162199)\ **Post date:** [March 16, 2022, 10:05am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/5 "2022-03-16T10:05:51Z")
## I tried to export all possible passwords as follows: ## [root@elk01 elasticsearch]# ./bin/elasticsearch-keystore list autoconfiguration.password\_hash keystore.seed xpack.security.http.ssl.keystore.secure\_password xpack.security.transport.ssl.keystore.secure\_password xpack.security.transport.ssl.truststore.secure\_password [root@elk01 elasticsearch]# ./bin/elasticsearch-keystore show autoconfiguration.password\_hash $2a$10$Jlv6FRis/WjOJHipf2aOuONJs8XiAPE7pe6t/SVl/SEeTS354ve16 [root@elk01 elasticsearch]# ./bin/elasticsearch-keystore show keystore.seed rgNDkOEu45py7mO4^ddc [root@elk01 elasticsearch]# ./bin/elasticsearch-keystore show xpack.security.http.ssl.keystore.secure\_password kyvxymiBQ9aSHWYNEeCU\_g [root@elk01 elasticsearch]# ./bin/elasticsearch-keystore show xpack.security.transport.ssl.keystore.secure\_password -AFRY\_HTT-ukBOLvUjUBOQ [root@elk01 elasticsearch]# ./bin/elasticsearch-keystore show xpack.security.transport.ssl.truststore.secure\_password -AFRY\_HTT-ukBOLvUjUBOQ ## But all the passwords are invalid [root@elk01 242]# keytool -importcert -trustcacerts -noprompt -keystore /etc/elasticsearch/certs/transport.p12 -alias new-ca -file /etc/elasticsearch/certs/242/242\_http\_ca.crt Enter keystore password: keytool error: java.io.IOException: keystore password was incorrect [root@elk01 242]# keytool -importcert -trustcacerts -noprompt -keystore /etc/elasticsearch/certs/transport.p12 -alias new-ca -file /etc/elasticsearch/certs/242/242\_http\_ca.crt Enter keystore password: keytool error: java.io.IOException: keystore password was incorrect [root@elk01 242]# keytool -importcert -trustcacerts -noprompt -keystore /etc/elasticsearch/certs/transport.p12 -alias new-ca -file /etc/elasticsearch/certs/242/242\_http\_ca.crt Enter keystore password: keytool error: java.io.IOException: keystore password was incorrect [root@elk01 242]# keytool -importcert -trustcacerts -noprompt -keystore /etc/elasticsearch/certs/transport.p12 -alias new-ca -file /etc/elasticsearch/certs/242/242\_http\_ca.crt Enter keystore password: keytool error: java.io.IOException: Invalid keystore format * * * I don't know what went wrong. I just want to add the CA to the trust. To test the remote cluster 😭 ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 17, 2022, 4:26am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/6 "2022-03-17T04:26:45Z")
```auto ./bin/Elasticsearch-keystore show xpack.security.transport.ssl.truststore.secure_password -AFRY_HTT-ukBOLvUjUBOQ ``` This is the password you need. I can't explain why it didn't work in your test, but this is the correct password. ---
**Author:** ![qq350162199](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qq350162199/32/83187_2.png) [@qq350162199](https://discuss.elastic.co/u/qq350162199)\ **Post date:** [March 18, 2022, 6:12am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/7 "2022-03-18T06:12:25Z")
It's okay. Thank you for your support. Thank the community. I'll try again. ---
**Author:** ![qq350162199](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qq350162199/32/83187_2.png) [@qq350162199](https://discuss.elastic.co/u/qq350162199)\ **Post date:** [March 19, 2022, 5:15pm UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/8 "2022-03-19T17:15:02Z")
[root@elk01 Elasticsearch]# ./bin/Elasticsearch-keystore show xpack.security.transport.ssl.truststore.secure\_password **-AFRY\_HTT-ukBOLvUjUBOQ** I noticed that the password was indeed correct. but,it says "Invalid keystore format" ![2022-03-20 011409](https://us1.discourse-cdn.com/elastic/original/3X/4/7/471082fc1debbd401631351c26fd50b81aff9203.png) I wonder if this is true in your test environment. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 20, 2022, 12:51am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/9 "2022-03-20T00:51:46Z")
If the format was truly invalid (which is theoretically possible, if the file had been corrupted), then your existing cluster would be unable to form. What version of `keytool` are you using? Can you try using the copy of keytool from the JDK that ships with Elasticsearch? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 17, 2022, 12:52am UTC](https://discuss.elastic.co/t/elasticsear-8-x-tls-question/299521/10 "2022-04-17T00:52:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.