# elasticsearch cannot read certificate file

**URL:** <https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 19, 2024, 7:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757 "2024-03-19T19:52:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vivere-dally](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivere-dally/32/132789_2.png) [@vivere-dally](https://discuss.elastic.co/u/vivere-dally)\
**Post date:** [March 19, 2024, 7:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757/1 "2024-03-19T19:52:47Z")

</div>

I generated a certificate file with certbot. It is placed in `/etc/letsencrypt/...`.

I created a group called `elk` where I added the `elasticsearch` user, and I recursively set it as the owning group for `/etc/letsencrypt` and recursively set the permissions to `770`.

When I start elasticsearch via `systemctl start elasticsearch.service`, it is not able to read the file? `Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/etc/letsencrypt/live/<domain>/fullchain.pem" "read") `

Why is that?

What strategy would you recommend to be able to use the same certificate for elasticsearch and kibana?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 20, 2024, 5:10am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757/2 "2024-03-20T05:10:00Z")

</div>

If you check the log, you should find that there is more detail there.

Elasticsearch requires that all configuration files are in the config directory (the security manager prevents it from reading arbitrary directories).

You can symlink the certbot managed files into the ES configuration dir.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2024, 5:10am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-read-certificate-file/355757/3 "2024-04-17T05:10:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.