# Elasticsearch 7.2 java client SSL configuration failing: bad\_certificate

**URL:** <https://discuss.elastic.co/t/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate/192766>\
**Category:** Elasticsearch\
**Created:** [July 29, 2019, 7:52pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate/192766 "2019-07-29T19:52:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lucas\_montenegro\_car](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucas_montenegro_car/32/36264_2.png) [@Lucas\_montenegro\_car](https://discuss.elastic.co/u/Lucas_montenegro_car)\
**Post date:** [July 29, 2019, 7:52pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate/192766/1 "2019-07-29T19:52:23Z")

</div>

After updating my elasticsearch to 7.2 and updating kibana, and after enabling security and therefore SSL, my java (spring) application lost connection to it. Spring JPA still doesn't support ES 7 and security+SSL was a paid plugin, and now it is part of the basic free package.

Because of this, I have been trying to configure my own client to send the requests using the RestHighLevelClient provided by elasticsearch SDK. With SSL turned of for the development mode, I have been able to connect and create my indexes, but as soon as I turn it on, I cannot get it to work.

I followed a tutorial to setup a valid self signed certificate to use with it. The tutorial uses a certificate tool provided with elasticsearch.

The steps were as follows:

1. Generate a CA: `bin/elasticsearch-certutil ca` ENTER ENTER
2. Generate a certificate from this CA: `bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12` ENTER ENTER ENTER

(both generated without passwords)

1. Install the certificates in the ES configuration file (elasticsearch.yml):

2. Defined user passwords: `bin/elasticsearch-setup-passwords interactive`

3. Generated a client certificate (this part I still do not fully understand): `bin/elasticsearch-certutil cert --ca config/certs/elastic-stack-ca.p12 -name "CN=xyz,OU=XXX Team,DC=mydomain,DC=com"`  
ENTER  
client.p12 ENTER  
ENTER

After these steps, since ES was running fine, I started creating the java part that connects to the ES server.

For that I instantiated a Keystore: `KeyStore truststore = KeyStore.getInstance("PKCS12");`

Then I loaded my client certificate (client.p12) from the classpath:

```
try (InputStream resource = new ClassPathResource(keystorePath).getInputStream()) {
		    truststore.load(resource, new char[] {});//keystore pass is empty
	} catch (NoSuchAlgorithmException | CertificateException | IOException e) {
		log.error(e.getMessage(), e);
	}

```

Then I built a SSL context as follows:  
`sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, new TrustSelfSignedStrategy());`

And finally, from that context I have created my rest client builder (that I use to create my RestHighLevelClient:

```
RestClientBuilder builder = RestClient.builder(
			    new HttpHost(elasticAddress, elasticPort, "https"))
			    .setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder.setSSLContext(sslContext));

return new RestHighLevelClient(builder);

```

The problem I'm getting is when I try to connect. In my java client I get this exception:  
`javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate`

and in elastic I get this exception:  
Caused by: javax.net.ssl.SSLHandshakeException: null cert chain

The elasticsearch documentation says that when these exceptions occur, the problem is: The SSLHandshakeException indicates that a self-signed certificate was returned by the client that is not trusted as it cannot be found in the truststore or keystore. This SSLException is seen on the client-side of the connection.

But it doesn't explain how to solve this problem. I have followed the official 7.2 documentation tutorial for certificate generation, and also for the java setup (the code they provide as example doesn't work and uses a JKS store which they don't explain how to generate).

This question is a clone of my original question in SO: [https://stackoverflow.com/questions/57259477/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate](https://stackoverflow.com/questions/57259477/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate)  
If you want som SO reputation, you can answer there 😉

---

<div class="post-metadata">

**Author:** ![Lucas\_montenegro\_car](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucas_montenegro_car/32/36264_2.png) [@Lucas\_montenegro\_car](https://discuss.elastic.co/u/Lucas_montenegro_car)\
**Post date:** [August 1, 2019, 1:47pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate/192766/2 "2019-08-01T13:47:44Z")

</div>

is bumping allowed in this forum?

---

<div class="post-metadata">

**Author:** ![Lucas\_montenegro\_car](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucas_montenegro_car/32/36264_2.png) [@Lucas\_montenegro\_car](https://discuss.elastic.co/u/Lucas_montenegro_car)\
**Post date:** [August 28, 2019, 9:34pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate/192766/3 "2019-08-28T21:34:15Z")

</div>

I still have no idea on how to solve this. The topic is about to close so I'm adding another reply.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2019, 9:34pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-java-client-ssl-configuration-failing-bad-certificate/192766/4 "2019-09-25T21:34:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.