# Elasticsearch-certutil error

**URL:** <https://discuss.elastic.co/t/elasticsearch-certutil-error/155569>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 6, 2018, 3:21pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569 "2018-11-06T15:21:07Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 6, 2018, 3:21pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/1 "2018-11-06T15:21:07Z")

</div>

Hi,  
when I issue the command `bin/elasticsearch-certutil cert -v --ca elastic-stack-ca.p12`

I get following, what could be issue?

```auto
Exception in thread "main" java.nio.file.NoSuchFileException: elastic-stack-ca.p12
        at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
        at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:214)
        at java.nio.file.Files.newByteChannel(Files.java:361)
        at java.nio.file.Files.newByteChannel(Files.java:407)
        at java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:384)
        at java.nio.file.Files.newInputStream(Files.java:152)
        at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readKeyStore(CertParsingUtils.java:68)
        at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readPkcs12KeyPairs(CertParsingUtils.java:127)
        at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.lambda$loadPkcs12CA$1(CertificateTool.java:341)
        at org.elasticsearch.xpack.security.cli.CertificateTool.withPassword(CertificateTool.java:931)
        at org.elasticsearch.xpack.security.cli.CertificateTool.access$100(CertificateTool.java:85)
        at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.loadPkcs12CA(CertificateTool.java:340)
        at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.getCAInfo(CertificateTool.java:328)
        at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.execute(CertificateTool.java:684)
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
        at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:77)
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
        at org.elasticsearch.cli.Command.main(Command.java:90)
        at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:137)

```

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [November 6, 2018, 9:13pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/2 "2018-11-06T21:13:53Z")

</div>

The error is rather obvious :`java.nio.file.NoSuchFileException: elastic-stack-ca.p12`

Your command asks `elasticsearch-certutil` to create a X.509 certificates and a private key, while using the CA key and certificate that is contained in `elastic-stack-ca.p12` file. However, you either haven't generated that file, or it lies in a different directory.

I would suggest that you read through our [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html), it would be a good starting point for using `elasticsearch-certutil`

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 6, 2018, 10:19pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/3 "2018-11-06T22:19:48Z")

</div>

The file exist, it is in the same directory as the previous issued command in "ca mode",

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [November 6, 2018, 10:27pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/4 "2018-11-06T22:27:25Z")

</div>

Can you please share the output of running

```auto
ls -la elastic-stack-ca.p12

```

when you are in that same directory?

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 6, 2018, 10:32pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/5 "2018-11-06T22:32:06Z")

</div>

drwxrwxrwt 1 root root 4.0K Nov 6 22:27 .  
drwxr-xr-x 1 root root 4.0K Nov 6 21:16 ..  
-rw------- 1 elasticsearch elasticsearch 2.5K Nov 6 22:27 elastic-stack-ca.p12  
drwx------ 2 elasticsearch elasticsearch 4.0K Nov 6 22:27 elasticsearch.sYIJmDY  
W  
drwxr-xr-x 2 elasticsearch elasticsearch 4.0K Nov 6 22:27 hsperfdata\_elasticsea  
rch

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 6, 2018, 10:33pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/6 "2018-11-06T22:33:09Z")

</div>

Is almost midnight here, will read answer tomorrow)

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [November 7, 2018, 6:58am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/7 "2018-11-07T06:58:20Z")

</div>

I assume you're running this as the `elasticsearch` user, so there shouldn't be any problem there.

Exactly what did you run to get that directory listing?  
If you ran the command that @ikakavas asked for:

```auto
ls -la elastic-stack-ca.p12

```

Then that output is quite strange - it would imply that `elastic-stack-ca.p12` is a directory, which it certainly shouldn't be.

Alternatively if you simply ran

```auto
ls -la

```

then where is the `bin/` directory from your original command

```auto
bin/elasticsearch-certutil ...

```

Something doesn't quite add up between the commands you say you're running and the output we're seeing.

You can try

```auto
bin/elasticsearch-certutil cert -v --ca ${PWD}/elastic-stack-ca.p12

```

which will eliminate any strange path problems and the exception message will be explicit about which file we tried to read.

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 7, 2018, 8:43am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/8 "2018-11-07T08:43:29Z")

</div>

Hi,

Yes, the output is what you get when you do `ls -la` or for specific file `ls -la elastic-stack-ca.p12`

-rw------- 1 elasticsearch elasticsearch 2.5K Nov 6 22:27 elastic-stack-ca.p12

We create these files in `/tmp` directory, btw  
it is centos7 install

to create this file i issued command (while i am in `/tmp`)

`/usr/share/elasticsearch/bin/elasticsearch-certutil ca`

of course its full path because i am in `/tmp`, this is no problem ,

I issued  
`/usr/share/elasticsearch/bin/elasticsearch-certutil cert -v --ca ${PWD}/elastic-stack-ca.p12`

Enter password for CA (/tmp/elastic-stack-ca.p12) :  
Exception in thread "main" java.nio.file.NoSuchFileException: /tmp/elastic-stack-ca.p13  
at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)  
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)  
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)  
at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:214)  
at java.nio.file.Files.newByteChannel(Files.java:361)  
at java.nio.file.Files.newByteChannel(Files.java:407)  
at java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:384)  
at java.nio.file.Files.newInputStream(Files.java:152)  
at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readKeyStore(CertParsingUtils.java:68)  
at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readPkcs12KeyPairs(CertParsingUtils.java:127)  
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.lambda$loadPkcs12CA$1(CertificateTool.java:341)  
at org.elasticsearch.xpack.security.cli.CertificateTool.withPassword(CertificateTool.java:931)  
at org.elasticsearch.xpack.security.cli.CertificateTool.access$100(CertificateTool.java:85)  
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.loadPkcs12CA(CertificateTool.java:340)  
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.getCAInfo(CertificateTool.java:328)  
at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.execute(CertificateTool.java:684)  
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)  
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)  
at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:77)  
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)  
at org.elasticsearch.cli.Command.main(Command.java:90)  
at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:137)

on a side note  
I did `echo $?` right after this command and I got `1`

Ok i am trying this on a new machine, this is just weird

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [November 7, 2018, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/9 "2018-11-07T08:53:10Z")

</div>

> [@jacobot](#):
>
> Exception in thread "main" java.nio.file.NoSuchFileException: /tmp/elastic-stack-ca.p13

**13**?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2018, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-error/155569/10 "2018-12-05T08:53:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.