# Elasticsearch TLS setup errors

**URL:** <https://discuss.elastic.co/t/elasticsearch-tls-setup-errors/231558>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 7, 2020, 2:06pm UTC](https://discuss.elastic.co/t/elasticsearch-tls-setup-errors/231558 "2020-05-07T14:06:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahabah](https://avatars.discourse-cdn.com/v4/letter/a/e19adc/32.png) [@ahabah](https://discuss.elastic.co/u/ahabah)\
**Post date:** [May 7, 2020, 2:06pm UTC](https://discuss.elastic.co/t/elasticsearch-tls-setup-errors/231558/1 "2020-05-07T14:06:03Z")

</div>

Hi, I setup elasticsearch on centos 3-nodes cluster. It worked well until I enabled xpack. I'm using .crt, .key, and ca.crt certs. Here are my config entries:  
xpack.security.enabled: true

xpack.security.http.ssl.enabled: true  
xpack.security.http.ssl.key: "path to key"  
xpack.security.http.ssl.certificate\_authorities: "path to ca cert"  
xpack.security.http.ssl.certificate: "path to cert"  
xpack.security.http.ssl.client\_authentication: optional

# xpack.security.transport.ssl.verification\_mode: certificate (commented out for trouble shooting)

xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.key: "path to cert"  
xpack.security.transport.ssl.certificate: "path to cert"  
xpack.security.transport.ssl.certificate\_authorities: ["path to ca cert"]

Running curl -XPUT 'localhost:9200/idx',  
curl: (52) Empty reply from server

running:  
curl --cert 'path to cert'--key 'path to key' --cacert 'path to ca cert' '[https://localhost:9200/\_xpack/security/\_authenticate?pretty](https://localhost:9200/_xpack/security/_authenticate?pretty)'  
produces:

- NSS error -12276 (SSL\_ERROR\_BAD\_CERT\_DOMAIN)

- Unable to communicate securely with peer: requested domain name does not match the server's certificate.

- Closing connection 0

curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.

Both the host FQDN and cert have the same domain name. What could be the problem.

---

<div class="post-metadata">

**Author:** ![ahabah](https://avatars.discourse-cdn.com/v4/letter/a/e19adc/32.png) [@ahabah](https://discuss.elastic.co/u/ahabah)\
**Post date:** [May 7, 2020, 5:11pm UTC](https://discuss.elastic.co/t/elasticsearch-tls-setup-errors/231558/2 "2020-05-07T17:11:34Z")

</div>

Running curl -v --cert /etc/elasticsearch/certs/certname --key /etc/elasticsearch/certs/keyname --cacert /etc/elasticsearch/certs/cacertname [https://FQDN:9200/\_xpack/security/\_authenticate?pretty](https://FQDN:9200/_xpack/security/_authenticate?pretty)

- About to connect() to FQDN port 9200 (#0)

- Connected to FQDN (IP Address) port 9200 (#0)

- Initializing NSS with certpath: sql:/etc/pki/nssdb

- CAfile: /etc/elasticsearch/certs/cacertname  
CApath: none

- SSL connection using TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384

> Host: FQDN:9200  
> Accept: _/_

\< HTTP/1.1 401 Unauthorized  
\< WWW-Authenticate: Bearer realm="security"  
\< WWW-Authenticate: ApiKey  
\< WWW-Authenticate: Basic realm="security" charset="UTF-8"  
\< content-type: application/json; charset=UTF-8  
\< content-length: 746  
\<  
{  
"error" : {  
"root\_cause" : [  
{  
"type" : "security\_exception",  
"reason" : "missing authentication credentials for REST request [/\_xpack/security/\_authenticate?pretty]",  
"header" : {  
"WWW-Authenticate" : [  
"Bearer realm="security"",  
"ApiKey",  
"Basic realm="security" charset="UTF-8""  
]  
}  
}  
],  
"type" : "security\_exception",  
"reason" : "missing authentication credentials for REST request [/\_xpack/security/\_authenticate?pretty]",  
"header" : {  
"WWW-Authenticate" : [  
"Bearer realm="security"",  
"ApiKey",  
"Basic realm="security" charset="UTF-8""  
]  
}  
},  
"status" : 401  
}

- Connection #0 to host FQDN left intact

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2020, 5:11pm UTC](https://discuss.elastic.co/t/elasticsearch-tls-setup-errors/231558/3 "2020-06-04T17:11:35Z")

</div>

Closed on June 4, 2020, 5:11pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.