Elasticsearch 7.4 unable to read truststore file

[bytemedwb (David W Boyd)]

All:
I am having the same error as described in this post:

Trying to figure out how to enable x-pack

I have been repeatedly failing to figure out how to properly enable x-pack. There's a lot of guides out there, but I still feel like I'm missing something. I built a new test machine to try to simplify this but am still running into trouble, so I turn to here for assistance. I'll reference this guide for example. https://www.elastic.co/blog/getting-started-with-elasticsearch-security Firstly, my environment characteristics. Mine is a bit different than the guide, as I'm using CentOS 7. I'm tes…

In my log file I get the following:
Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - access to read truststore file [/etc/pki/java/truststore.jks] is blocked; SSL resources should be placed in the [/etc/elasticsearch/dspc] directory

Followed by:
Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/etc/pki/java/truststore.jks" "read")

However the elasticsearch user should have permissions to the file as shown below:
[root@dspcnode04 dspc]# ls -alt /etc/pki/java total 60 drwxr-xr-x+ 15 root root 195 May 28 15:48 .. drwxr-xr-x. 2 root root 83 May 28 15:48 . -rw-r--r-- 1 root root 2467 May 28 15:48 keystore.jks -rw-r--r-- 1 root root 3992 May 28 15:48 keystore.p12 -rw-r--r-- 1 root root 53152 May 28 15:39 truststore.jks lrwxrwxrwx. 1 root root 40 May 25 20:39 cacerts -> /etc/pki/ca-trust/extracted/java/cacerts

Add to this I can run the command:

su elasticsearch -c 'cat /etc/pki/java/truststore.jks'

And see the file. The other posts I have found similar offer no help.
I am installing this ES on an existing cluster and need to use the existing certificates and trust/key stores.

I have looked through the tutorial and not found anything helpful.
Any idea on how to even approach debugging this?

UPDATE:
I have just tried the following:

1. Linking the jks files in /etc/pki/java to /etc/elasticsearch/dspc and changing the elasticsearch.yml file to point to /etc/elasticsearch/dspc. ----- That did not work.

2. I copied the jks files to /etc/elasticsearch/dspc , left the ownership and permissions (root, 644) the same and had the elasticsearch.yml file point to them. ---- That did work.

So now my updated question:
Why does Elasticsearch 7.4 require the files to be in the configuration directory??

[ikakavas (Ioannis Kakavas)]

@bytemedwb

Why does Elasticsearch 7.4 require the files to be in the configuration directory??

This is not 7.4 specifically, all versions have this requirement.

[bytemedwb (David W Boyd)]

Thanks, but this really make managing common certificates and key/trust stores in a large cluster difficult.

Was someone just trying to implement extra security?

I have multiple applications and tools that need to share common certs and keys. This is all managed through thousands of lines of puppet code.
At least provide me a variable to override the fixed location.

[ikakavas (Ioannis Kakavas)]

@bytemedwb

Was someone just trying to implement extra security?

Spot on, that would certainly be us.

We grant ( via a SecurityManager policy ) the permission to read files only from within the configuration directory.

@bytemedwb

At least provide me a variable to override the fixed location.

I think you are looking for ES_PATH_CONF, we don't have an override setting path only for key/certificate material