# Elasticsearch crashes with PEM certificate error when using pfx split into separate certificate and key **URL:** \ **Category:** Elasticsearch\ **Created:** [May 18, 2021, 7:56am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247 "2021-05-18T07:56:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![keacw](https://avatars.discourse-cdn.com/v4/letter/k/9d8465/32.png) [@keacw](https://discuss.elastic.co/u/keacw)\ **Post date:** [May 18, 2021, 7:56am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247/1 "2021-05-18T07:56:19Z")
> [ERROR][c.a.o.s.s.DefaultOpenDistroSecurityKeyStore] [[example.com](http://example.com)] Your keystore or PEM does not contain a key. If you specified a key password, try removing it. If you did not specify a key password, perhaps you need to if the key is in fact password-protected. Maybe you just confused keys and certificates. Given a machine certificate example.pfx I can extract the key and certificate into two separate files example-certificate.pem example-certificate-key.pem using the below commands from [Converting pfx to pem using openssl](https://stackoverflow.com/questions/15413646/converting-pfx-to-pem-using-openssl) Extracts the private key form a PFX to a PEM file: ```auto openssl pkcs12 -in example.pfx -nocerts -out key.pem ``` Exports the certificate (includes the public key only): ```auto openssl pkcs12 -in example.pfx -clcerts -nokeys -out example-certificate.pem ``` Removes the password from the extracted private key (Elasticsearch does not support keys on private keys): ```auto openssl rsa -in key.pem -out example-certificate-key.pem ``` I keep hitting the same error, is there a way I can confirm my pem files are correct or not to narrow down if the error is caused by Elasticsearch, the pem conversion, the pfx files I recieve, or something else? ---
**Author:** ![keacw](https://avatars.discourse-cdn.com/v4/letter/k/9d8465/32.png) [@keacw](https://discuss.elastic.co/u/keacw)\ **Post date:** [May 18, 2021, 9:12am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247/2 "2021-05-18T09:12:30Z")
Elasticsearch requires the private key to be in pkcs8 format. Convert the extracted key to pkcs8 with ``` > openssl pkcs8 -in example-certifate-key.pem -topk8 -nocrypt -out example-certificate-key-pkcs8.pem ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 19, 2021, 1:20am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247/3 "2021-05-19T01:20:58Z")
Welcome to our community! 😃 And thanks heaps for providing your solution! ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 19, 2021, 5:46am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247/4 "2021-05-19T05:46:44Z")
> [@keacw](#): > > Elasticsearch requires the private key to be in pkcs8 format. A few things that I'd like to clarify: 1. Elasticsearch does **not** require pkcs8 format for a private key. The initial error is most likely because you didn't specify the password for the password protected key file (as suggested by the error message). In fact, Both `example-certifate-key.pem` and the later `example-certificate-key-pkcs8.pem` files should be of pkcs8 format. Just the later is not password protected because you explicilty specified `-nocrypt`. 2. The error message shows that you are using OpenDistro for Elasticsearch. It's a different product from the actual Elasticsearch, especially when it comes to security. Therefore, it is possible that it may behave different or doesn't support the same things that we support. ---
**Author:** ![keacw](https://avatars.discourse-cdn.com/v4/letter/k/9d8465/32.png) [@keacw](https://discuss.elastic.co/u/keacw)\ **Post date:** [May 19, 2021, 9:49am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247/5 "2021-05-19T09:49:08Z")
Thanks for clarifying, I will confirm your solution and update our documentation as well the answer here at our next upgrade. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2021, 9:49am UTC](https://discuss.elastic.co/t/elasticsearch-crashes-with-pem-certificate-error-when-using-pfx-split-into-separate-certificate-and-key/273247/6 "2021-06-16T09:49:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.