# Elasticsearch node http certificate expiration error **URL:** \ **Category:** Elasticsearch\ **Created:** [January 15, 2025, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-node-http-certificate-expiration-error/373228 "2025-01-15T13:54:20Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Post date:** [January 15, 2025, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-node-http-certificate-expiration-error/373228/1 "2025-01-15T13:54:21Z")
While i try to connects the kibana to elasticsearch i get the following error in the **kibana's logs** and when i try to load the kibana i get the `Kibana server is not ready yet.` : > [ERROR][elasticsearch-service] Unable to retrieve version information from Elasticsearch nodes. certificate has expired but the when i check the certificate it has not expired yet. Here is my `elasticsearch.yml` file ```auto xpack.security.http.ssl: enabled: true verification_mode: full client_authentication: required keystore.path: certs/http.keystore.p12 truststore.path: certs/truststore.p12 ``` and here is the `kibana.yml` ```auto elasticsearch.hosts: ['https://192.168.7.153:50002'] # kibana to cluster elasticsearch.ssl.truststore.path: /etc/kibana/truststore.p12 elasticsearch.ssl.keystore.path: /etc/kibana/cluster.keystore.p12 elasticsearch.ssl.alwaysPresentCertificate: true elasticsearch.ssl.verificationMode: full ``` and when i check my cert expiration date with the following openssl command: - first extracting cert `openssl pkcs12 -in http.keystore.p12 -clcerts -nokeys -out del-certificate.crt` - then checking it expiration date ` openssl x509 -in ./del-certificate.crt -noout -enddate` i get the `notAfter=Dec 9 08:06:40 2025 GMT` which shows the certificate is not expired. when in `kibana.yml` file i change the `elasticsearch.ssl.verificationMode: full` to `elasticsearch.ssl.verificationMode: none` the problem goes away which indicate the problem probably must be with the http certificate provided by elasticsearch to kibana. Is there any tips and suggestion how to troubleshoot? by the way i am trying to have mutalTLS enabled between kibana and cluster. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 16, 2025, 2:56am UTC](https://discuss.elastic.co/t/elasticsearch-node-http-certificate-expiration-error/373228/2 "2025-01-16T02:56:52Z")
A couple of suggestions to start with: 1. Try using `openssl s_client -showcerts -connect 192.168.7.153:50002` to double check that ES is presenting the certificate that you think it should be. 2. Double check the date/time on your Kibana server ---
**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Post date:** [January 18, 2025, 7:26am UTC](https://discuss.elastic.co/t/elasticsearch-node-http-certificate-expiration-error/373228/3 "2025-01-18T07:26:21Z")
first of all thanks for the reply. I had checked system time and it was ok, i checked it again and it is still ok on both elasticsearch and kibana mahcine. about checking the certificate that elasticsearch represent to kibana as you told i did the following: 1. first i ran the command `openssl s_client -showcerts -connect 192.168.7.153:50002` and i got 2. then as my `xpack.security.http.ssl.keystore.path` refere to `certs/http.keystore.p12` i ran the command `openssl pkcs12 -in http.keystore.p12 -nokeys -clcerts -nodes` and i got so as the both outputs are the same, i guess it is safe to assume the elasticsearch is representing the intended certificate? and also i guess the second line of the first picture is kind of a proof that the certificate is not expired? ---
**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Post date:** [January 19, 2025, 5:55am UTC](https://discuss.elastic.co/t/elasticsearch-node-http-certificate-expiration-error/373228/4 "2025-01-19T05:55:37Z")
UPDATE: surprisingly (at least for me 🙂 ) i have a logstash config as follow: ```auto output { elasticsearch { hosts => ["https://192.168.7.153:50002"] user => "elastic" password => "a_pass" index => "test_index" ssl_truststore_path => "/etc/logstash/certs/truststore.p12" ssl_truststore_password => "a_[ass" ssl_keystore_path => "/etc/logstash/certs/logst ash-es.keystore.p12" ssl_keystore_password => "a_pass" ssl_enabled => true ssl_verification_mode => full } } ``` and even with `ssl_verification_mode => full` it is working fine. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [January 20, 2025, 3:37am UTC](https://discuss.elastic.co/t/elasticsearch-node-http-certificate-expiration-error/373228/5 "2025-01-20T03:37:08Z")
I'm in guesswork territory now, but... Maybe the signing certificate has expired? It looks like your Elasticsearch is configured to send only the leaf certificate (which is normal), so Kibana is relying on the CA from `/etc/kibana/truststore.p12` Has that CA expired? ---
**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Post date:** [January 25, 2025, 12:50pm UTC](https://discuss.elastic.co/t/elasticsearch-node-http-certificate-expiration-error/373228/6 "2025-01-25T12:50:37Z")
That was not the problem. i even tried regenerating ```auto xpack.security.http.ssl.keystore.path: certs/http.keystore.p12 ``` but that did not solve the problem too. I would try again solving the problem in the coming days and if i came across any solution i would post it here, meanwhile any more tips would be appreciated.