# Elasticsearch fails to start when xpack security is enabled **URL:** \ **Category:** Elasticsearch\ **Created:** [February 22, 2020, 10:17pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-when-xpack-security-is-enabled/220514 "2020-02-22T22:17:45Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ljacobs7211](https://avatars.discourse-cdn.com/v4/letter/l/cab0a1/32.png) [@ljacobs7211](https://discuss.elastic.co/u/ljacobs7211)\ **Post date:** [February 22, 2020, 10:17pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-when-xpack-security-is-enabled/220514/1 "2020-02-22T22:17:46Z")
Caused by: java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:614) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:163) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:309) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:253) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.5.0.jar:7.5.0] ... 6 more Caused by: java.lang.reflect.InvocationTargetException at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:163) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:309) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:253) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.5.0.jar:7.5.0] ... 6 more Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl] at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:449) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:430) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:121) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.(XPackPlugin.java:142) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:163) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:309) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:253) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.5.0.jar:7.5.0] ... 6 more Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - access to read truststore file [/usr/share/elasticsearch/config/elastic-certificates.p12] is blocked; SSL resources should be placed in the [/etc/elasticsearch] directory at org.elasticsearch.xpack.core.ssl.TrustConfig.blockedTrustConfigFile(TrustConfig.java:135) ~[?:?] at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:72) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:384) ~[?:?] at java.util.HashMap.computeIfAbsent(HashMap.java:1138) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:446) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:430) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:121) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.(XPackPlugin.java:142) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:163) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:309) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:253) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.5.0.jar:7.5.0] ... 6 more Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/usr/share/elasticsearch/config/elastic-certificates.p12" "read") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:?] at java.security.AccessController.checkPermission(AccessController.java:1036) ~[?:?] at java.lang.SecurityManager.checkPermission(SecurityManager.java:408) ~[?:?] at java.lang.SecurityManager.checkRead(SecurityManager.java:747) ~[?:?] at sun.nio.fs.UnixChannelFactory.open(UnixChannelFactory.java:255) ~[?:?] at sun.nio.fs.UnixChannelFactory.newFileChannel(UnixChannelFactory.java:143) ~[?:?] at sun.nio.fs.UnixChannelFactory.newFileChannel(UnixChannelFactory.java:156) ~[?:?] at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:217) ~[?:?] at java.nio.file.Files.newByteChannel(Files.java:374) ~[?:?] at java.nio.file.Files.newByteChannel(Files.java:425) ~[?:?] at java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:420) ~[?:?] at java.nio.file.Files.newInputStream(Files.java:159) ~[?:?] at org.elasticsearch.xpack.core.ssl.TrustConfig.getStore(TrustConfig.java:95) ~[?:?] at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:65) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:384) ~[?:?] at java.util.HashMap.computeIfAbsent(HashMap.java:1138) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:446) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:430) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:121) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.(XPackPlugin.java:142) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:163) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:309) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.node.Node.(Node.java:253) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.5.0.jar:7.5.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.5.0.jar:7.5.0] ... 6 more ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [February 24, 2020, 12:56am UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-when-xpack-security-is-enabled/220514/2 "2020-02-24T00:56:08Z")
> [@ljacobs7211](#): > > Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/usr/share/elasticsearch/config/elastic-certificates.p12" "read") File permissions on this file maybe? Is that your certificate file? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 24, 2020, 6:06am UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-when-xpack-security-is-enabled/220514/3 "2020-02-24T06:06:23Z")
> [@ljacobs7211](#): > > Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - access to read truststore file [/usr/share/elasticsearch/config/elastic-certificates.p12] is blocked; SSL resources should be placed in the [/etc/elasticsearch] directory The message is quite clear I think, you need to put your files in the (or a subdirectory of the) configuration directory, which in your case is `/etc/elasticsearch` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 23, 2020, 6:06am UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-when-xpack-security-is-enabled/220514/4 "2020-03-23T06:06:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.