# Elasticsearch-certutil http

**URL:** <https://discuss.elastic.co/t/elasticsearch-certutil-http/286230>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 8, 2021, 11:54am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http/286230 "2021-10-08T11:54:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![karpaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karpaz/32/95602_2.png) [@karpaz](https://discuss.elastic.co/u/karpaz)\
**Post date:** [October 8, 2021, 11:54am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http/286230/1 "2021-10-08T11:54:18Z")

</div>

Hello everyone,  
I figured out that when generating http certificates by tool `./bin/elasticsearch-certutil http` than it didn't work when I have password protected `*.pem/*.key` files. It does generate certs only if it's used -nodes when creating CA cert.

My commands to create RootCA.key and RootCA.pem

```auto
openssl req -x509 -nodes -new -sha256 -days 10950 -newkey rsa:4096 -keyout RootCA.key -out RootCA.pem

```

After this is created theese files `RootCA.key and RootCA.pem` it's okay and utility `elasticsearch-certutil http` can be used, but when I generate CA without `-nodes` with password, than utility `elasticsearch certutil http` cannot be used and show's me errors:

```auto
Exception in thread "main" ElasticsearchException[Failed to read private key from /etc/elasticsearch/RootCA.key]; nested: IOException[PBE parameter parsing error: expecting the object identifier for AES cipher];
	at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.readPrivateKey(HttpCertificateCommand.java:1016)
	at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.readPemCA(HttpCertificateCommand.java:985)
	at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.findExistingCA(HttpCertificateCommand.java:784)
	at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.execute(HttpCertificateCommand.java:168)
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:114)
	at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:95)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:114)
	at org.elasticsearch.cli.Command.main(Command.java:79)
	at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:143)
Caused by: java.io.IOException: PBE parameter parsing error: expecting the object identifier for AES cipher
	at java.base/com.sun.crypto.provider.PBES2Parameters.parseES(PBES2Parameters.java:335)
	at java.base/com.sun.crypto.provider.PBES2Parameters.engineInit(PBES2Parameters.java:239)
	at java.base/java.security.AlgorithmParameters.init(AlgorithmParameters.java:311)
	at java.base/sun.security.x509.AlgorithmId.decodeParams(AlgorithmId.java:155)
	at java.base/sun.security.x509.AlgorithmId.<init>(AlgorithmId.java:137)
	at java.base/sun.security.x509.AlgorithmId.parse(AlgorithmId.java:449)
	at java.base/javax.crypto.EncryptedPrivateKeyInfo.<init>(EncryptedPrivateKeyInfo.java:98)
	at org.elasticsearch.xpack.core.ssl.PemUtils.parsePKCS8Encrypted(PemUtils.java:330)
	at org.elasticsearch.xpack.core.ssl.PemUtils.readPrivateKey(PemUtils.java:91)
	at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.readPrivateKey(HttpCertificateCommand.java:1009)
	... 9 more

```

I proceed by this manual:

> **[Set up basic security for the Elastic Stack plus secured HTTPS traffic |...](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html#encrypt-http-communication)**

PS: I cannot find similiar issue, so I created this one.  
btw. this is my first ticket

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 11, 2021, 4:26am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http/286230/2 "2021-10-11T04:26:35Z")

</div>

Thanks for the report. I can reproduce this (though it depends on the OpenSSL version) and will see what's triggering it.

It seems to be something about the specifics of the encryption algorithm being used for the PKCS#8 key, but I'll need to track down the specifics.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 11, 2021, 5:25am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http/286230/3 "2021-10-11T05:25:12Z")

</div>

I've opened [PemUtils fails to parse PKCS#8 private keys when using PBES2 · Issue #78901 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/78901)

It looks like (at least in recent versions) OpenSSL defaults to using PBES1 when converting RSA keys to PKCS#8 (`openssl pkcs8 -topk8`) but PBSE2 when using `openssl req`.

Parsing PBES2 in Java is a little trickier than PBES1, and we don't support it correctly at the moment.

You can probably work around this by generating the key with `-nodes` and then encrypting it with

```auto
openssl pkcs8 -topk8 -in RootCA-nodes.key -out RootCA.key -v1 PBE-MD5-DES

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2021, 5:25am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-http/286230/4 "2021-11-08T05:25:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.