# Elasticsearch Java REST clients **URL:** \ **Category:** Elasticsearch\ **Created:** [July 12, 2018, 7:12pm UTC](https://discuss.elastic.co/t/elasticsearch-java-rest-clients/139825 "2018-07-12T19:12:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![John\_McAfee1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_mcafee1/32/47236_2.png) [@John\_McAfee1](https://discuss.elastic.co/u/John_McAfee1)\ **Post date:** [July 12, 2018, 7:12pm UTC](https://discuss.elastic.co/t/elasticsearch-java-rest-clients/139825/1 "2018-07-12T19:12:44Z")
Hello, I am using Elasticsearch 6.2.2 and am attempting to create a connection to my ES server using the Java Rest Clients. Here is the code I am using for the connection: credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials("username", "password")); RestHighLevelClient client = new RestHighLevelClient( RestClient.builder(new HttpHost("server-name", 9200, "https")) .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() { @Override public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpClientBuilder) { return httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider); } })); when executed, I get the following error: Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem at sun.security.ssl.Alerts.getSSLException(Unknown Source) at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source) at sun.security.ssl.Handshaker.processLoop(Unknown Source) at sun.security.ssl.Handshaker$1.run(Unknown Source) at sun.security.ssl.Handshaker$1.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source) at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:281) at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:339) ... 9 more Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(Unknown Source) at sun.security.validator.PKIXValidator.engineValidate(Unknown Source) at sun.security.validator.Validator.validate(Unknown Source) at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source) at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ... 18 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) at java.security.cert.CertPathBuilder.build(Unknown Source) It looks like it is looking for the trustStore/keystore. Not sure why I need to provide that for Basic Auth. With the regular Java Client and XPack installed, it was necessary to use the PreBuiltXPack.... client instead of the regular client. Does the REST client require such a change, or am I just missing something? Thanks a bunch! ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 13, 2018, 1:49am UTC](https://discuss.elastic.co/t/elasticsearch-java-rest-clients/139825/2 "2018-07-13T01:49:07Z")
> It looks like it is looking for the trustStore/keystore. Not sure why I need to provide that for Basic Auth. This is not trying to use TLS/Keys for authentication, the problem is that the rest client doesn't trust the certificate that your Elasticsearch node is providing. You _can_ use TLS for authentication (PKI), but that's a separate issue. Your Elasticsearch cluster is using certificates that are signed by a CA that your client JVM doesn't trust. The 3 likely causes are: - You generated a custom CA for your cluster - You are using a corporate CA for your cluster, but your client JVM doesn't trust that cert - You are using a public CA, but your client JVM doesn't have a complete set of up-to-date CA certs. This is quite common when using OpenJDK builds. This doc provides some guidance on configuring a truststore in your client. The exact steps you need will depend on how you've configured SSL for http on your ES nodes. - [Encrypted communication | Java REST Client [6.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/client/java-rest/6.2/_encrypted_communication.html) ---
**Author:** ![John\_McAfee1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_mcafee1/32/47236_2.png) [@John\_McAfee1](https://discuss.elastic.co/u/John_McAfee1)\ **Post date:** [July 13, 2018, 7:20pm UTC](https://discuss.elastic.co/t/elasticsearch-java-rest-clients/139825/3 "2018-07-13T19:20:45Z")
Tim, Thanks for the reply! I will get with our admins and try to sort this out. Much appreciated! John ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 10, 2018, 7:25pm UTC](https://discuss.elastic.co/t/elasticsearch-java-rest-clients/139825/4 "2018-08-10T19:25:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.