# Elasticsearch security error for window setup

**URL:** <https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 31, 2019, 5:45pm UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778 "2019-05-31T17:45:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [May 31, 2019, 5:45pm UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/1 "2019-05-31T17:45:40Z")

</div>

Hi Team,

I am getting below error while running the elastic search security step for my window ELK version 7.1.1 setup:

> **[Secure Elasticsearch with TLS encryption and role-based access control](https://www.elastic.co/blog/getting-started-with-elasticsearch-security)**
>
> Secure your Elasticsearch clusters -- and the other components of the Elastic Stack -- with node-to-node TLS and role-based access control (RBAC). These features and more are now available free with the default distribution of Elasticsearch and...

Error details:

2019-05-31T19:37:11,613][ERROR][o.e.b.Bootstrap] [CMS] Exception  
java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin]  
at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:614) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.plugins.PluginsService.(PluginsService.java:163) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.node.Node.(Node.java:308) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.node.Node.(Node.java:252) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:211) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:211) ~[elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:325) [elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) [elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) [elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) [elasticsearch-cli-7.1.1.jar:7.1.1]  
at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.1.1.jar:7.1.1]  
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) [elasticsearch-7.1.1.jar:7.1.1]  
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.1.1.jar:7.1.1]  
Caused by: java.lang.reflect.InvocationTargetException  
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]  
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?]  
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?]  
at java.lang.reflect.Constructor.newInstance(Unknown Source) ~[?:1.8.0\_211]  
at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.1.1.jar:7.1.1]  
... 15 more  
Caused by: org.elasticsearch.ElasticsearchException: failed to initialize a TrustManagerFactory  
at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:61) ~[?:?]  
at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:382) ~[?:?]  
at java.util.HashMap.computeIfAbsent(Unknown Source) ~[?:1.8.0\_211]  
at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:434) ~[?:?]  
at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:119) ~[?:?]  
at org.elasticsearch.xpack.core.XPackPlugin.(XPackPlugin.java:144) ~[?:?]  
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]  
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?]  
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?]  
at java.lang.reflect.Constructor.newInstance(Unknown Source) ~[?:1.8.0\_211]  
at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.1.1.jar:7.1.1]  
... 15 more  
Caused by: java.io.IOException: Short read of DER length  
at sun.security.util.DerInputStream.getLength(Unknown Source) ~[?:?]  
at sun.security.util.DerValue.init(Unknown Source) ~[?:?]  
at sun.security.util.DerValue.(Unknown Source) ~[?:?]  
at sun.security.util.DerValue.(Unknown Source) ~[?:?]  
at sun.security.pkcs12.PKCS12KeyStore.engineLoad(Unknown Source) ~[?:?]  
at java.security.KeyStore.load(Unknown Source) ~[?:1.8.0\_211]  
at org.elasticsearch.xpack.core.ssl.TrustConfig.getStore(TrustConfig.java:89) ~[?:?]  
at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:58) ~[?:?]  
at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:382) ~[?:?]  
at java.util.HashMap.computeIfAbsent(Unknown Source) ~[?:1.8.0\_211]  
at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:434) ~[?:?]  
at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:119) ~[?:?]  
at org.elasticsearch.xpack.core.XPackPlugin.(XPackPlugin.java:144) ~[?:?]  
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]  
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?]  
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) ~[?:?]  
at java.lang.reflect.Constructor.newInstance(Unknown Source) ~[?:1.8.0\_211]  
at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.1.1.jar:7.1.1]  
... 15 more

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 3, 2019, 3:01am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/2 "2019-06-03T03:01:15Z")

</div>

There's some sort of problem with the file you have configured as a `truststore`.

Probably `xpack.security.transport.ssl.truststore.path`  
Can you:

1. Provide the contents of your `elasticsearch.yml` file (formatted as code, using the `</>` button).
2. The output of running `keytool` on your truststore file

```auto
keytool -list -keystore /path/to/your/truststore.p12

```

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [June 3, 2019, 3:54am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/3 "2019-06-03T03:54:46Z")

</div>

Hi Tim,

Please find the elasticsearch.yaml file configuration:

```
cluster.name: logging-dev
network.host: 0.0.0.0
network.bind_host: 0.0.0.0
network.publish_host: 0.0.0.0`Preformatted text`
http.port: 9200
node.data: true
node.ingest: true
node.master: true
node.max_local_storage_nodes: 1
node.name: CMS
path.data: C:\Elastic\Elasticsearch\data
path.logs: C:\Elastic\Elasticsearch\logs
transport.tcp.port: 9300
xpack.license.self_generated.type: basic
cluster.initial_master_nodes: node-1
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
```

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [June 3, 2019, 4:01am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/4 "2019-06-03T04:01:16Z")

</div>

Hi @TimV ,

I am new on Elastic Search. I have installed new version of ELK 7.1.1.

So Can you help me step by step to configure security on elastic search.  
Its urgent for me.  
Thanks in advance for your help.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 3, 2019, 4:40am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/5 "2019-06-03T04:40:22Z")

</div>

> [@Sharma3007](#):
>
> Can you help me step by step to configure security on Elasticsearch

There's a tutorial for 7.1 here:

- [Tutorial: Getting started with security | Elasticsearch Guide [7.1] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/7.1/security-getting-started.html)

> [@Sharma3007](#):
>
> Its urgent for me.

We (Elastic) offer [paid support plans](https://www.elastic.co/subscriptions) and consulting services if those are of interest to you.  
Otherwise, these forums are provided as a free service to the community and we attempt to answer questions as quickly as we can, but cannot adjust our priorities to accommodate your urgency.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 3, 2019, 4:41am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/6 "2019-06-03T04:41:41Z")

</div>

> [@Sharma3007](#):
>
> elastic-certificates.p12

And what does

```auto
keytool -list -keystore /path/to/config/elastic-certificates.p12

```

give?

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [June 3, 2019, 5:50am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/7 "2019-06-03T05:50:44Z")

</div>

> [@TimV](#):
>
> keytool -list -keystore

Yes I followed the same url , but for windows it little but confusing.

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [June 3, 2019, 6:21am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/8 "2019-06-03T06:21:56Z")

</div>

> [@TimV](#):
>
> keytool -list -keystore /path/to/config/elastic-certificates.p12

Hi @TimV,

I am getting error that Keytool is not recognize while running above command

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2019, 6:26am UTC](https://discuss.elastic.co/t/elasticsearch-security-error-for-window-setup/183778/9 "2019-07-01T06:26:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.