# Encrypt HTTP Client **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, language-clients\ **Created:** [May 18, 2021, 7:31am UTC](https://discuss.elastic.co/t/encrypt-http-client/273245 "2021-05-18T07:31:02Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![NareshReddy](https://avatars.discourse-cdn.com/v4/letter/n/b19c9b/32.png) [@NareshReddy](https://discuss.elastic.co/u/NareshReddy)\ **Post date:** [May 18, 2021, 7:31am UTC](https://discuss.elastic.co/t/encrypt-http-client/273245/1 "2021-05-18T07:31:02Z")
When updating the certificate using the following commands "elasticsearch-certutil http". At end it is showing the error. Exception in thread "main" java.lang.IllegalArgumentException: ca certificate is not a CA! at org.elasticsearch.xpack.security.cli.CertGenUtils.generateSignedCerti ficate(CertGenUtils.java:177) at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.writeCert ificateAndKeyDetails(HttpCertificateCommand.java:346) at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.writeZip( HttpCertificateCommand.java:262) at org.elasticsearch.xpack.security.cli.HttpCertificateCommand.execute(H ttpCertificateCommand.java:235) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwar eCommand.java:75) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:1 16) at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:80) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:1 16) at org.elasticsearch.cli.Command.main(Command.java:79) at org.elasticsearch.xpack.security.cli.CertificateTool.main(Certificate Tool.java:138) ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [May 18, 2021, 10:38am UTC](https://discuss.elastic.co/t/encrypt-http-client/273245/2 "2021-05-18T10:38:29Z")
Please share your code as well, as this makes it rather hard to debug. Also please format your code snippets for readability. The 2nd line contains the following statement > java.lang.IllegalArgumentException: ca certificate is > not a CA! Are you making sure that your CA configuration for the truststore is a CA cert? See [Encrypted communication | Java REST Client [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/client/java-rest/7.12/_encrypted_communication.html) ---
**Author:** ![NareshReddy](https://avatars.discourse-cdn.com/v4/letter/n/b19c9b/32.png) [@NareshReddy](https://discuss.elastic.co/u/NareshReddy)\ **Post date:** [May 19, 2021, 10:58am UTC](https://discuss.elastic.co/t/encrypt-http-client/273245/3 "2021-05-19T10:58:02Z")
We are enabling SSL for elastic search, for this we are installing the certificate. 1. Generated CSR and private key using Open SSL in Linux. 2. Using the same we have generated the .p7b certificate from the origanization. 3. Using the certificate and private key we have generated the .pfx file from OPEN SSL, using the following command. Command 1:" openssl pkcs7 -print\_certs -in Cert.p7b -out Cert.cer" Command 2:"openssl pkcs12 -export -in Cert.cer -inkey private.key -out certificatename.pfx -certfile Cert.cer" 4. When updating the certificate using the elastic search command in the following url([Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html)) and when it ask to provide the end zip file name, it would throw the error message on the screen. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [May 19, 2021, 11:54am UTC](https://discuss.elastic.co/t/encrypt-http-client/273245/4 "2021-05-19T11:54:40Z")
If I understand it correctly, your intention is to use the corporate signed certificate as the CA to sign the certificates required for elasticsearch's HTTPS interface. When you invoke `elasticsearch-certutil http`, you answered `y` to `Use an existing CA?` and entered the path to the file `certificatename.pfx` for the following question of `CA Path: `. You then ran into the error in the original post. The error message is `ca certificate is not a CA!` and it literally means the certificate stored in `certificatename.pfx` cannot be used as a CA. A certificate can have different constraints and not every one of them can be a CA. This can be verified with following command: ```auto openssl pkcs12 -in certificatename.pfx -nodes -nokeys | openssl x509 -text -noout -in - ``` Look for `Basic Constraints` in the output. It will say `CA:FALSE` if the certificate cannot be used as a CA. To fix this, you need regenerate your certificate so the CA constraint is removed. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2021, 11:54am UTC](https://discuss.elastic.co/t/encrypt-http-client/273245/5 "2021-06-16T11:54:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.