# Elasticsearch is not starting owing to wrong file permission **URL:** \ **Category:** Elasticsearch\ **Created:** [February 7, 2018, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-owing-to-wrong-file-permission/118855 "2018-02-07T13:55:47Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![itspecialistsimon](https://avatars.discourse-cdn.com/v4/letter/i/838e76/32.png) [@itspecialistsimon](https://discuss.elastic.co/u/itspecialistsimon)\ **Post date:** [February 7, 2018, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-owing-to-wrong-file-permission/118855/1 "2018-02-07T13:55:47Z")
Hi everyone, my Elasticsearch instance doesn't start. Here the logfile's extract: Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/opt/cert/elastic-certificates.p12" "read") at java.security.AccessControlContext.checkPermission(Unknown Source) ~[?:1.8.0\_161] at java.security.AccessController.checkPermission(Unknown Source) ~[?:1.8.0\_161] at java.lang.SecurityManager.checkPermission(Unknown Source) ~[?:1.8.0\_161] at java.lang.SecurityManager.checkRead(Unknown Source) ~[?:1.8.0\_161] at sun.nio.fs.UnixChannelFactory.open(Unknown Source) ~[?:?] at sun.nio.fs.UnixChannelFactory.newFileChannel(Unknown Source) ~[?:?] at sun.nio.fs.UnixChannelFactory.newFileChannel(Unknown Source) ~[?:?] at sun.nio.fs.UnixFileSystemProvider.newByteChannel(Unknown Source) ~[?:?] at java.nio.file.Files.newByteChannel(Unknown Source) ~[?:1.8.0\_161] at java.nio.file.Files.newByteChannel(Unknown Source) ~[?:1.8.0\_161] at java.nio.file.spi.FileSystemProvider.newInputStream(Unknown Source) ~[?:1.8.0\_161] at java.nio.file.Files.newInputStream(Unknown Source) ~[?:1.8.0\_161] at org.elasticsearch.xpack.core.ssl.CertUtils.readKeyStore(CertUtils.java:273) ~[?:?] at org.elasticsearch.xpack.core.ssl.CertUtils.trustManager(CertUtils.java:267) ~[?:?] at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:70) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:412) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:448) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:91) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.(XPackPlugin.java:127) ~[?:?] at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?] at java.lang.reflect.Constructor.newInstance(Unknown Source) ~[?:1.8.0\_161] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:534) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:485) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:402) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:146) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.node.Node.(Node.java:303) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.node.Node.(Node.java:246) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:213) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) ~[elasticsearch-6.2.0.jar:6.2.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.2.0.jar:6.2.0] ... 6 more I already changed the permission for /opt/cert/ to 777, but it still doesn't work. I'm appreciative for any help. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [February 7, 2018, 2:07pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-owing-to-wrong-file-permission/118855/2 "2018-02-07T14:07:47Z")
This is not about the permissions, but the fact that you need to move the certificates into the `config` directory of Elasticsearch. Elasticsearch is using the java security manager on startup, that is configured by a rule, that only allows opening of files in the config directory but not in arbitrary directories. ---
**Author:** ![itspecialistsimon](https://avatars.discourse-cdn.com/v4/letter/i/838e76/32.png) [@itspecialistsimon](https://discuss.elastic.co/u/itspecialistsimon)\ **Post date:** [February 7, 2018, 2:14pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-owing-to-wrong-file-permission/118855/3 "2018-02-07T14:14:53Z")
Is there a default config directory? Because there is no config directory neither in /etc/elasticsearch nor in /usr/share/elasticsearch. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [February 7, 2018, 4:07pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-owing-to-wrong-file-permission/118855/4 "2018-02-07T16:07:52Z")
The config directory depends on how you installed elasticsearch. `/etc/elasticsearch` is used when you use a package, but `$DIR/config/` is used when you use the tar.gz image. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 7, 2018, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-owing-to-wrong-file-permission/118855/5 "2018-03-07T16:08:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.