# Error with SSL keystore when trying to do remote reindex **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 31, 2022, 9:23am UTC](https://discuss.elastic.co/t/error-with-ssl-keystore-when-trying-to-do-remote-reindex/317800 "2022-10-31T09:23:21Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Post date:** [October 31, 2022, 9:23am UTC](https://discuss.elastic.co/t/error-with-ssl-keystore-when-trying-to-do-remote-reindex/317800/1 "2022-10-31T09:23:21Z")
Hi, I'm trying to perform a remote reindex and the remote ES has been configured with SSL by someone else. I was able to get the `abc.p12` cert of the remote ES, as well as the password that was auto-generated (an alpha-numeric string). I'm not very familiar with the TLS/cert concept and I'm a bit confused as to what I should do. I currently have the following configurations in my `/etc/elasticsearch/elasticsearch.yml`. ```auto reindex.remote.whitelist: ["x.x.x.x:9200"] reindex.ssl.keystore.path: abc.p12 xpack.security.enabled: true xpack.security.http.ssl.enabled: false xpack.security.enrollment.enabled: true xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: certs/t.p12 truststore.path: certs/t.p12 ``` I'm taking this [page](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/configuring-tls.html#node-certificates) as reference. I overwrote the `xpack.security.transport.ssl.keystore.secure_password` and `xpack.security.transport.ssl.truststore.secure_password` with the one I have for `abc.p12`. However, I got the error message `failed to load SSL configuration [xpack.security.transport.ssl] - cannot read configured [PKCS12] keystore (as a truststore) [/etc/elasticsearch/certs/t.p12] - this is usually caused by an incorrect password; (a keystore password was provided)`. If I don't overwrite the 2 passwords, then I get another error instead: `cannot read configured [PKCS12] keystore [/etc/elasticsearch/abc.p12] - this is usually caused by an incorrect password` `t.p12` was used by the previous administrator to reindex from other remote ES. I'm not really sure if I need to provide my own `t.p12` (or what it is for, actually). What should I do? Thank you. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 3, 2022, 5:54am UTC](https://discuss.elastic.co/t/error-with-ssl-keystore-when-trying-to-do-remote-reindex/317800/2 "2022-11-03T05:54:56Z")
`abc.p12` and `t.p12` are two different keystore files. Do they share the same password? In any case, you need configure their passwords separately because they are different settings, one is for reindex SSL and the other is for transport SSL. You can refer [this page](https://www.elastic.co/guide/en/elasticsearch/reference/8.5/docs-reindex.html#reindex-ssl) for configuring SSL settings for reindex. ---
**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Post date:** [November 3, 2022, 6:29am UTC](https://discuss.elastic.co/t/error-with-ssl-keystore-when-trying-to-do-remote-reindex/317800/3 "2022-11-03T06:29:51Z")
`abc.p12` and `t.p12` have different passwords. So I would need to run `bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password` and `bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password` with the `t.p12` password and `bin/elasticsearch-keystore add reindex.ssl.keystore.secure_password` with the `abc.p12` password? ---
**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Post date:** [November 4, 2022, 3:11am UTC](https://discuss.elastic.co/t/error-with-ssl-keystore-when-trying-to-do-remote-reindex/317800/4 "2022-11-04T03:11:51Z")
I set the passwords as mentioned and it works now. ---
**Author:** ![rachel\_gomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rachel_gomez/32/108615_2.png) [@rachel\_gomez](https://discuss.elastic.co/u/rachel_gomez)\ **Post date:** [November 4, 2022, 7:53am UTC](https://discuss.elastic.co/t/error-with-ssl-keystore-when-trying-to-do-remote-reindex/317800/5 "2022-11-04T07:53:06Z")
Tips to Fix SSL Certificate Error Diagnose the problem with an online tool. Install an intermediate certificate on your web server. Generate a new Certificate Signing Request. Upgrade to a dedicated IP address. Get a wildcard SSL certificate. Change all URLS to HTTPS. Renew your SSL certificate. Greeting, Rachel Gomez ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 2, 2022, 7:53am UTC](https://discuss.elastic.co/t/error-with-ssl-keystore-when-trying-to-do-remote-reindex/317800/6 "2022-12-02T07:53:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.