# Elasticsearch connection issue **URL:** \ **Category:** Elasticsearch\ **Tags:** docker\ **Created:** [April 20, 2023, 8:38pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480 "2023-04-20T20:38:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Buddha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buddha/32/101523_2.png) [@Buddha](https://discuss.elastic.co/u/Buddha)\ **Post date:** [April 20, 2023, 8:38pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/1 "2023-04-20T20:38:17Z")
Hello, A bit of a noob on certs stuff and I had a previous question where I think I was complicating things to solve a connection issue to my Elasticsearch deployment: The following is an image and an error message: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/eac0b2fc52ab7679b6820e351877856663e1f4b7.png) ```auto Caught exception while preforming bulk operation to Elasticsearch: Elasticsearch.Net.ElasticsearchClientException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.. Call: Status code unknown from: POST /_bulk ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. ``` Right now, set up is simple: - I run the docker compose file as outlined here: [Install Elasticsearch with Docker | Elasticsearch Guide [8.7] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#docker-compose-file) - The application is on one server and the Elasticsearch deployment is on another server I was wondering how people solved this issue with their deployment? FYI: The servers will be not connected to the internet, so I could use http... maybe I could add say http.port into the ENV to connect via http? Mike ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 20, 2023, 9:16pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/2 "2023-04-20T21:16:23Z")
This is a self signed certificate which explains the behavior. When using curl, you can disable this check using -k option but this is only intended for tests and not for production, where you need to provide a real ssl certificate. ---
**Author:** ![Buddha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buddha/32/101523_2.png) [@Buddha](https://discuss.elastic.co/u/Buddha)\ **Post date:** [April 21, 2023, 1:46am UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/3 "2023-04-21T01:46:25Z")
Hmm, bring a noob on these certificate matters, could you point me to any documentation of how to dockerize an Elasticsearch cluster using a real ssl certificate? On the other hand, my deployment will never see the internet, is there anyway of using http? Mike ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 21, 2023, 2:01am UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/4 "2023-04-21T02:01:50Z")
Which client are you using to connect to Elasticsearch? ---
**Author:** ![Buddha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buddha/32/101523_2.png) [@Buddha](https://discuss.elastic.co/u/Buddha)\ **Post date:** [April 21, 2023, 1:04pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/5 "2023-04-21T13:04:01Z")
To connect with .net, - [Elasticsearch.Net](http://Elasticsearch.Net) - Serilog.Sinks.Elasticsearch To connect with python, - Elasticsearch I could turn off verify SSL, but would like to know the right way if I do open things up to the internet and keep things safe. Mike ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 21, 2023, 1:23pm UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/6 "2023-04-21T13:23:38Z")
> [@Buddha](#): > > Hmm, bring a noob on these certificate matters, could you point me to any documentation of how to dockerize an Elasticsearch cluster using a real ssl certificate? I think you could start from here: [Manually configure security | Elasticsearch Guide [master] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/manually-configure-security.html) ---
**Author:** ![Buddha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buddha/32/101523_2.png) [@Buddha](https://discuss.elastic.co/u/Buddha)\ **Post date:** [April 22, 2023, 10:29am UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/7 "2023-04-22T10:29:30Z")
I've read that I could add a self signed certificate in Ubuntu to make it a trusted entity. Based on this documentation: [Installing a root CA certificate in the trust store | Ubuntu](https://ubuntu.com/server/docs/security-trust-store) I've copied all 4 .crt files found in the docker container folders: /usr/local/share/ca-certificates/ca /usr/local/share/ca-certificates/es01 /usr/local/share/ca-certificates/es02 /usr/local/share/ca-certificates/es03 to the host folder: /usr/local/share/ca-certificates then ran: sudo update-ca-certificate But that still gave me the same error. Maybe I'm not providing the right file? Wondering if anyone had any thoughts on this? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 20, 2023, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-connection-issue/330480/8 "2023-05-20T10:30:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.