# Elasticsearch 8.9.1 - How to extract the self-signed CA and server cert

**URL:** <https://discuss.elastic.co/t/elasticsearch-8-9-1-how-to-extract-the-self-signed-ca-and-server-cert/341304>\
**Category:** Elasticsearch\
**Created:** [August 21, 2023, 9:45pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-how-to-extract-the-self-signed-ca-and-server-cert/341304 "2023-08-21T21:45:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![saltspreader](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@saltspreader](https://discuss.elastic.co/u/saltspreader)\
**Post date:** [August 21, 2023, 9:45pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-how-to-extract-the-self-signed-ca-and-server-cert/341304/1 "2023-08-21T21:45:07Z")

</div>

Hi there,

Elasticsearch v 8.9.1 installed via ES apt repo on ubuntu 22.04.

I need to extract the self-signed CA and https cert from my elasticsearch 8.9.1 setup to copy to a gitlab instance for https connections. I've done the following to extract the CA and server crt; can someone please confirm this is correct?

```auto
openssl pkcs12 -in /etc/elasticsearch/http.p12 -cacerts -nokeys -out CA.crt
openssl pkcs12 -in /etc/elasticsearch/http.p12 -clcerts -nokeys -out server.crt

```

I need to confirm as when I copy the above CA.crt and server.crt to my gitlab server into the trusted-certs dir, run gitlab-ctl reconfigure, and then use the gitlab embedded openssl to connect to my ES instance I get an error of `verify error:num=19:self signed certificate in certificate chain`.

Before I make a post on the gitlab support site about why my self-signed cert/CA arent being recognized I'd like to confirm that I am indeed extracting the CA and server certs from ES correctly.

Thanks!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 21, 2023, 10:46pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-how-to-extract-the-self-signed-ca-and-server-cert/341304/2 "2023-08-21T22:46:25Z")

</div>

Hi @saltspreader welcome to the community!

First you should have got a `http_ca.crt` if you did the default install

```auto
$ ls certs/
http.p12 http_ca.crt transport.p12

```

2nd try with a curl to make sure you have the correct CA this should work

`curl -v --cacert /path/to/http_ca.crt -u elastic https://elastichost:9200`

If that works then then I would move on to Git Lab...  
I suspect you will need to reference the CA for the GitLab Connection  
or install it in the OS root trust keystore for CAs on the Client Ubuntu Server

---

<div class="post-metadata">

**Author:** ![saltspreader](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@saltspreader](https://discuss.elastic.co/u/saltspreader)\
**Post date:** [August 22, 2023, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-how-to-extract-the-self-signed-ca-and-server-cert/341304/3 "2023-08-22T15:06:46Z")

</div>

Deleted my comments from 5 mins ago.

I think I've sorted my issue based on your curl syntax above. I've been using port 9300, which I (incorrectly) assumed was the https port.

Doing a curl as you suggest above to port _9200_ on my ES server from my gitlab server works just fine.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2023, 3:07pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-how-to-extract-the-self-signed-ca-and-server-cert/341304/4 "2023-09-19T15:07:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.