# Elasticsearch not starting with IOException error when using p12 files from outside CA

**URL:** <https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 10, 2022, 4:04pm UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855 "2022-08-10T16:04:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamesp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesp/32/73041_2.png) [@jamesp](https://discuss.elastic.co/u/jamesp)\
**Post date:** [August 10, 2022, 4:04pm UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855/1 "2022-08-10T16:04:34Z")

</div>

Hello,

I successfully set up xpack basic security when I used self-signed certificates using Elasticsearch tools. When I had an internal authority create the p12 files for me following information from the Elasticsearch procedures I get this error when starting a node:

> Failed to load SSL configuration [xpack.security.transport.ssl]; nested: ElasticsearchException[failed to initialize SSL TrustManager]; nested: IOException[toDerInputStream rejects tag type 80];

Could this be anything other than an issue with the p12 file?

What is the best way to have an outside CA create the p12 file for use in Elasticsearch nodes. Will possibly run into this issue when getting HTTP p12 files created as well.

Thanks!

Jim

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [August 11, 2022, 12:38am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855/2 "2022-08-11T00:38:34Z")

</div>

It seems to me that your p12 file is invalid. Can you try to read it using a different tool such as `openssl`, e.g.:

```auto
openssl pkcs12 -info -nokeys -in YOUR_FILE

```

---

<div class="post-metadata">

**Author:** ![jamesp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesp/32/73041_2.png) [@jamesp](https://discuss.elastic.co/u/jamesp)\
**Post date:** [August 11, 2022, 8:46pm UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855/3 "2022-08-11T20:46:46Z")

</div>

That seems to have been the issue. I'm hoping to get the proper p12 files soon.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2022, 8:46pm UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-with-ioexception-error-when-using-p12-files-from-outside-ca/311855/4 "2022-09-08T20:46:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.