elasticsearch cannot read certificate file

Elastic Stack Elasticsearch
1

I generated a certificate file with certbot. It is placed in /etc/letsencrypt/....

I created a group called elk where I added the elasticsearch user, and I recursively set it as the owning group for /etc/letsencrypt and recursively set the permissions to 770.

When I start elasticsearch via systemctl start elasticsearch.service, it is not able to read the file? Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/etc/letsencrypt/live/<domain>/fullchain.pem" "read")

Why is that?

What strategy would you recommend to be able to use the same certificate for elasticsearch and kibana?

2

If you check the log, you should find that there is more detail there.

Elasticsearch requires that all configuration files are in the config directory (the security manager prevents it from reading arbitrary directories).

You can symlink the certbot managed files into the ES configuration dir.

2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.