# Error unable to find valid certification path **URL:** \ **Category:** Logstash\ **Created:** [March 2, 2018, 6:13pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304 "2018-03-02T18:13:45Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [March 2, 2018, 6:13pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/1 "2018-03-02T18:13:46Z")
Hi, I'm trying to configure TLS between Logstash and Elastic. Currently I have configured (correctly, it seems), TLS on my cluster (3 nodes) and I can access to it using Kibana. In my Logstash (installed in localhost on each servers) I'm using elasticsearch output filter but when I start it I get only the error: ``` [2018-03-02T18:59:24,125][WARN][logstash.licensechecker.licensereader] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://elastic:xxxxxx@localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://elastic:xxxxxx@localhost:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2018-03-02T18:59:25,400][INFO][logstash.pipeline] Pipeline has terminated {:pipeline_id=>"main", :thread=>"# ["https://localhost:9200/"] user => "elastic" password => "changeme" index => "roger-%{+YYYY.MM.dd}" template_name => "roger-*" template => "/etc/logstash/templates/roger-template-es5x.json" cacert => "/etc/logstash/certs/caC.cer" ssl => true ssl_certificate_verification => false } ``` can you help me? I know that `ssl` should not be mandatory since I specify https in `hosts` key and I know also that should not be used `ssl_certificate_verification`. thanks in advance ---
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [March 7, 2018, 1:10pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/2 "2018-03-07T13:10:51Z")
just an update. I have fixed it adding the CA to Java keystore. here the used commands: ``` echo -n | openssl s_client -connect localhost:9200 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ./ca_logstash.cer keytool -import -alias saelk -file ca_logstash.cer -keystore /usr/lib/jvm/jre-1.8.0-openjdk-1.8.0.65-3.b17.el7.x86_64/lib/security/cacerts ``` ---
**Author:** ![Sa\_Jain](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@Sa\_Jain](https://discuss.elastic.co/u/Sa_Jain)\ **Post date:** [March 8, 2018, 9:41am UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/3 "2018-03-08T09:41:33Z")
Hi Roger, I am facing a similar problem, can you help pls I have used Search guard, generated the demo certificates. when i use the root-ca.pem that search guard has generated in Logstash. It does not work ☹ My logstash and elastic are on different servers output { elasticsearch { hosts =\> "10.16.11.172:9200" user =\> "admin" password =\> "admin" ssl =\> true ssl\_certificate\_verification =\> false cacert =\> "/usr/share/logstash/root-ca.pem" template\_name =\> "ocean-logs-\*" index =\> "%{index\_name}-%{+YYYY.MM.dd}" } } ---
**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Post date:** [March 9, 2018, 5:34pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/4 "2018-03-09T17:34:02Z")
I'm not sure if we can talk about Search Guard here. anyway, on another cluster I have used it. taking a look to your output section, you should have `hosts => ["https://10.16.11.172:9200"]` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 6, 2018, 5:34pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/5 "2018-04-06T17:34:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 2, 2018, 9:52pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/6 "2018-07-02T21:52:18Z")
---
**Author:** ![hallaoui](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hallaoui/32/77342_2.png) [@hallaoui](https://discuss.elastic.co/u/hallaoui)\ **Post date:** [September 3, 2020, 8:39am UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/7 "2020-09-03T08:39:16Z")
Hi Roger, I faced same issue using below config then I fixed it following what you shared in the previous post. ```auto Config: elasticsearch { hosts => ["https://45cd934da9d443b187c79007c5bcb586.10.30.30.204.ip.es.io:9243"] index => "cars" user => "elastic" password => "05b7jz5qldMlRX5tUAQnV8ff" document_type => "used_car_for_sell" } Error: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Fix: # echo -n | openssl s_client -connect 45cd934da9d443b187c79007c5bcb586.10.30.30.204.ip.es.io:9243 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ./ca_logstash.cer # sudo keytool -import -alias saelk -file ca_logstash.cer -keystore /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.262.b10-0.el8_2.x86_64/jre/lib/security/cacerts ``` Thanks for your support. Hamid ---
**Author:** ![TheSumitBanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thesumitbanik/32/89748_2.png) [@TheSumitBanik](https://discuss.elastic.co/u/TheSumitBanik)\ **Post date:** [June 9, 2021, 11:43am UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/8 "2021-06-09T11:43:51Z")
Where should I use the commands for openssl and keytool? ---
**Author:** ![Bilanda](https://avatars.discourse-cdn.com/v4/letter/b/e56c9b/32.png) [@Bilanda](https://discuss.elastic.co/u/Bilanda)\ **Post date:** [June 9, 2021, 12:48pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/9 "2021-06-09T12:48:35Z")
On the server runing logstash. Replace `localhost:9200` by `your_ip_server:9200` (or `DNS_name:9200`) if elasticsearch is not running on the same server than your logstash. ---
**Author:** ![TheSumitBanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thesumitbanik/32/89748_2.png) [@TheSumitBanik](https://discuss.elastic.co/u/TheSumitBanik)\ **Post date:** [June 9, 2021, 1:50pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/10 "2021-06-09T13:50:20Z")
Thanks! I have executed the commands but my question is what value to fill in cacert in .conf file? (what should be the path) ---
**Author:** ![Bilanda](https://avatars.discourse-cdn.com/v4/letter/b/e56c9b/32.png) [@Bilanda](https://discuss.elastic.co/u/Bilanda)\ **Post date:** [June 9, 2021, 2:09pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/11 "2021-06-09T14:09:04Z")
If you register Elasticsearch's root certificate in Logstash keystore, then you don't need to add a cacert in your logstash conf file. It's used by default. You'll only need to register username & password, as Hallaoui mentionned. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 9, 2021, 8:52pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/12 "2021-06-09T20:52:05Z")
Please start your own topic for this @TheSumitBanik 🙂 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 9, 2021, 8:52pm UTC](https://discuss.elastic.co/t/error-unable-to-find-valid-certification-path/122304/13 "2021-06-09T20:52:08Z")