# ElasticSearch with SSL? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 25, 2019, 2:21pm UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278 "2019-10-25T14:21:53Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![xemyleex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xemyleex/32/56623_2.png) [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Post date:** [October 25, 2019, 2:21pm UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/1 "2019-10-25T14:21:53Z")
Hello, I am trying to configure elasticsearch with SSL, but I get these error, I followed this tutorial: [https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html) So I created the Certificate Authority: `bin/elasticsearch-certutil ca` Then I generated the certificate and the private key: `bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12` Then I configurate elasticsearch.yml: `xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certss/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certss/elastic-certificates.p12 ` Then I restarted elasticsearch: `systemctl start elasticsearch` But I get these errors: > ``` > # sudo tail -f /var/log/elasticsearch/elasticsearch.log > java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin] > ... > Caused by: java.lang.reflect.InvocationTargetException > ... > Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.http.ssl] > ... > Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - not permitted to read truststore file [/etc/elasticsearch/certss/elastic-certificates.p12] > ... > Caused by: java.nio.file.AccessDeniedException: /etc/elasticsearch/certss/elastic-certificates.p12 > ... > > ``` This command says that that plugin is installed: ` # sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack` ` ERROR: this distribution of Elasticsearch contains X-Pack by default` Any idea? ---
**Author:** ![uher3805](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/uher3805/32/49121_2.png) [@uher3805](https://discuss.elastic.co/u/uher3805)\ **Post date:** [October 28, 2019, 8:09pm UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/2 "2019-10-28T20:09:38Z")
Hi, I am encountering the same issue with elasticsearch 7.4.0 - in case you solved it I am interested to learn now, thanks ---
**Author:** ![MiTschMR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mitschmr/32/48254_2.png) [@MiTschMR](https://discuss.elastic.co/u/MiTschMR)\ **Post date:** [October 29, 2019, 7:46am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/3 "2019-10-29T07:46:29Z")
Hi @xemyleex If you read the error messages carefully, you can see that one is `failed to initialize SSL TrustManager - not permitted to read truststore file [/etc/elasticsearch/certss/elastic-certificates.p12]` and another is `java.nio.file.AccessDeniedException: /etc/elasticsearch/certss/elastic-certificates.p12`. These messages already tell enough. The Elasticsearch process does not have sufficient permission to access the truststore file. Configure the permission accordingly and it should work. Hope this helps. ---
**Author:** ![xemyleex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xemyleex/32/56623_2.png) [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Post date:** [October 30, 2019, 9:45am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/4 "2019-10-30T09:45:49Z")
Ok thanks, but now I get this error: ``` [2019-10-30T10:38:58,146][ERROR][o.e.b.Bootstrap] [localhost.localdomain] Exception java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin] .... Caused by: java.lang.reflect.InvocationTargetException .... Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl] .... Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager .... Caused by: java.io.IOException: keystore password was incorrect at .... Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption. .... Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl] ... Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager .... Caused by: java.io.IOException: keystore password was incorrect .... Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption. ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 30, 2019, 10:36am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/5 "2019-10-30T10:36:14Z")
Then as the error informs you, `elastic-certificates.p12` is password protected and you don't configure elasticsearch with the password so it can't decrypt and read it. Read point 3 in the [tutorial](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html#tls-transport) you followed ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 30, 2019, 10:37am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/6 "2019-10-30T10:37:24Z")
If you don't get _exactly_ the same error message, then it probably is better for you to start a new thread, provide _your_ configuration and the exact error message _you_ are getting so that folk can more easily assist you ---
**Author:** ![xemyleex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xemyleex/32/56623_2.png) [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Post date:** [October 30, 2019, 4:36pm UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/7 "2019-10-30T16:36:39Z")
Ok now it works thanks 🙂 Last question: If I try to open this page in the browser: [https://localhost:9200](https://localhost:9200) Then I get this error: ssl\_error\_rx\_record\_too\_long Why? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 30, 2019, 4:56pm UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/8 "2019-10-30T16:56:52Z")
You have only configured transport layer for TLS, not the http layer ,so you cant access elasticsearch over https with your browser. Go back to the tutorial you are reading, it's all there 🙂 ---
**Author:** ![xemyleex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xemyleex/32/56623_2.png) [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Post date:** [October 31, 2019, 11:18am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/9 "2019-10-31T11:18:18Z")
Thanks so much. I have last question 🙂 I tryed to open this page in the browser: [https://localhost:9200](https://localhost:9200/) And I get this: ![Schermata%20del%202019-10-31%2012-15-27](https://us1.discourse-cdn.com/elastic/original/3X/7/3/73e0d7736b5673094348700ffc935f31b72c84af.png) So I tryed to insert the default username and password: ```auto elastic changeme ``` But it doesn't work because I get "failed to authenticate user [elastic]": ![Schermata%20del%202019-10-31%2012-15-39](https://us1.discourse-cdn.com/elastic/original/3X/9/0/90caacfeb9d894bdea1439c8d27470b967676e1a.png) I tryed to change the password too but I get this: ```auto $ sudo bin/elasticsearch-setup-passwords interactive [sudo] password di emiliano: SSL connection to https://127.0.0.1:9200/_security/_authenticate?pretty failed: No subject alternative names present Please check the elasticsearch SSL settings under xpack.security.http.ssl. ERROR: Failed to establish SSL connection to elasticsearch at https://127.0.0.1:9200/_security/_authenticate?pretty. ``` This is my elasticsearch.yml ssl setting: ```auto xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certss/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certss/elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: /etc/elasticsearch/certss/elastic-certificates.p12 xpack.security.http.ssl.truststore.path: /etc/elasticsearch/certss/elastic-certificates.p12 ``` Any idea? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 31, 2019, 11:31am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/10 "2019-10-31T11:31:53Z")
Please don't post images of text as they are hard to read, may not display correctly for everyone, and are not searchable. Instead, paste the text and format it with `` icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer. It would be great if you could update your post to solve this. ---
**Author:** ![xemyleex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xemyleex/32/56623_2.png) [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Post date:** [October 31, 2019, 11:36am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/11 "2019-10-31T11:36:27Z")
Done 🙂 ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 31, 2019, 11:42am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/12 "2019-10-31T11:42:39Z")
> [@xemyleex](#): > > So I tryed to insert the default username and password: > elastic > changeme There hasn't been a default password for a few releases now: > **[Default Password Removal in X-Pack 6.0](https://www.elastic.co/blog/default-password-removal-elasticsearch-and-x-pack-6-0)** > > X-Pack 6.0 removes the default password found in previous version and replaces it with a simple and secure getting started experience. > [@xemyleex](#): > > I tryed to change the password too but I get this: > > ```auto > SSL connection to https://127.0.0.1:9200/_security/_authenticate?pretty failed: No subject alternative names present > > ``` The certificate you are using for TLS in the http layer, doesn't contain a SAN with the hostname or the IP address of the node (localhost) where elasticserach is running so `elasticsearch-setup-passwords` can't securely connect to it. You can either: - Generate a new certificate and key in a new keystore for the http layer, using `--dns` or `--ip` as described in the blog you are following and use that for `xpack.security.http.ssl.keystore.path` and `xpack.security.http.ssl.truststore.path` - 1. Set `xpack.security.http.ssl.enabled: false` 2. Restart elasticsearch 3. Run `bin/elasticsearch-setup-passwords interactive` again 4. Set `xpack.security.http.ssl.enabled: true` 5. Restart elasticsearch ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2019, 11:45am UTC](https://discuss.elastic.co/t/elasticsearch-with-ssl/205278/13 "2019-11-28T11:45:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.