# ES 7.8 X-Pack not returning whole cert chain root ca, intermediate and server cert **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [August 2, 2020, 7:27pm UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475 "2020-08-02T19:27:24Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mankuuuuu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mankuuuuu/32/73208_2.png) [@mankuuuuu](https://discuss.elastic.co/u/mankuuuuu)\ **Post date:** [August 2, 2020, 7:27pm UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475/1 "2020-08-02T19:27:25Z")
I am trying to enable TLS on the elasticsearch http layer but not able to get all the certificates in the certificate chain. Settings - ```auto xpack.security.enabled: true xpack.security.http.ssl.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.key: "/etc/elasticsearch/certs/server.key" xpack.security.http.ssl.verification_mode: certificate xpack.security.http.ssl.certificate: "/etc/elasticsearch/certs/server.crt" xpack.security.http.ssl.certificate_authorities: ["/etc/elasticsearch/certs/ca_bundle.crt"] xpack.security.transport.ssl.key: "/etc/elasticsearch/certs/common.key" xpack.security.transport.ssl.certificate: "/etc/elasticsearch/certs/common.crt" xpack.security.transport.ssl.verification_mode: none ``` ssl.key -\> server private key ssl.certificate -\> server public certificate ssl.ca -\> root + intermediate + server When I am doing openssl s\_client -showcerts -host [server.com](http://server.com) -port 9200 Getting below output ```auto Start Time: 1596395294 Timeout : 7200 (sec) Verify return code: 21 (unable to verify the first certificate) --- ``` Is there any workaround or I am missing something here please guide me through it. Thanks ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [August 3, 2020, 2:28am UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475/2 "2020-08-03T02:28:03Z")
The certificate settings in Elasticsearch are a little bit different than how most HTTP servers are configured. Many HTTP servers have separate config serttings for the server's leaf certificate and the issuing chain. That seems to be what you expect here, but ES doesn't do that. Instead the`xpack.security.http.ssl.certificate` setting points to a certificate chain. That is, you need to do something like: ```auto cat root.crt intermediate.crt server.crt >> server-chain.crt ``` and then set ```auto xpack.security.http.ssl.certificate: "/etc/elasticsearch/certs/server-chain.crt" ``` It looks like the `xpack.security.http.ssl.certificate_authorities` setting has lead you in the wrong direction. In ES this is the list of CAs to trust when SSL client authentication is enabled. That can be the CA (chain) that issued the node's HTTP certificate, but it does not need to be (and often isn't). If you do not have client authenticate enabled, then it essentially unused. ---
**Author:** ![mankuuuuu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mankuuuuu/32/73208_2.png) [@mankuuuuu](https://discuss.elastic.co/u/mankuuuuu)\ **Post date:** [August 3, 2020, 6:19am UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475/3 "2020-08-03T06:19:08Z")
Thank you for your quick reply @TimV I have tried what you have mentioned in your comment but I am getting ```auto Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL KeyManagerFactory at org.elasticsearch.xpack.core.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:73) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:438) ~[?:?] at java.util.HashMap.computeIfAbsent(HashMap.java:1225) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$5(SSLService.java:526) ~[?:?] at java.util.HashMap.forEach(HashMap.java:1425) ~[?:?] at java.util.Collections$UnmodifiableMap.forEach(Collections.java:1521) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:524) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:142) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:397) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:263) ~[?:?] at org.elasticsearch.node.Node.lambda$new$11(Node.java:484) ~[elasticsearch-7.8.0.jar:7.8.0] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:271) ~[?:?] at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1624) ~[?:?] at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?] at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?] at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?] at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578) ~[?:?] at org.elasticsearch.node.Node.(Node.java:488) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.node.Node.(Node.java:266) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:227) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:227) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:393) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.8.0.jar:7.8.0] ... 6 more Caused by: java.security.KeyStoreException: Certificate chain is not valid at sun.security.pkcs12.PKCS12KeyStore.setKeyEntry(PKCS12KeyStore.java:646) ~[?:?] at sun.security.pkcs12.PKCS12KeyStore.engineSetKeyEntry(PKCS12KeyStore.java:596) ~[?:?] at sun.security.util.KeyStoreDelegator.engineSetKeyEntry(KeyStoreDelegator.java:111) ~[?:?] at java.security.KeyStore.setKeyEntry(KeyStore.java:1167) ~[?:?] at org.elasticsearch.xpack.core.ssl.CertParsingUtils.getKeyStore(CertParsingUtils.java:183) ~[?:?] at org.elasticsearch.xpack.core.ssl.CertParsingUtils.keyManager(CertParsingUtils.java:174) ~[?:?] at org.elasticsearch.xpack.core.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:71) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:438) ~[?:?] at java.util.HashMap.computeIfAbsent(HashMap.java:1225) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$5(SSLService.java:526) ~[?:?] at java.util.HashMap.forEach(HashMap.java:1425) ~[?:?] at java.util.Collections$UnmodifiableMap.forEach(Collections.java:1521) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:524) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:142) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:397) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:263) ~[?:?] at org.elasticsearch.node.Node.lambda$new$11(Node.java:484) ~[elasticsearch-7.8.0.jar:7.8.0] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:271) ~[?:?] at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1624) ~[?:?] at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?] at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?] at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?] at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578) ~[?:?] at org.elasticsearch.node.Node.(Node.java:488) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.node.Node.(Node.java:266) ~[elasticsearch-7.8.0.jar:7.8.0] ``` My root ca and intermediate is Digicert and I downloaded them from here [https://www.digicert.com/kb/digicert-root-certificates.htm#roots](https://www.digicert.com/kb/digicert-root-certificates.htm#roots) [https://www.digicert.com/kb/digicert-root-certificates.htm#intermediates](https://www.digicert.com/kb/digicert-root-certificates.htm#intermediates) Verified chain - ```auto openssl verify -CAfile DigiCertHighAssuranceEVRootCA.crt.pem -untrusted DigiCertSHA2HighAssuranceServerCA.crt.pem azara.crt domain.crt: OK ``` and my order is root -\> intermediates -\> server.crt passing this complete bundle in the configuration throwing error of invalid certificate chain. Is anything I am doing wrong here ? ---
**Author:** ![mankuuuuu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mankuuuuu/32/73208_2.png) [@mankuuuuu](https://discuss.elastic.co/u/mankuuuuu)\ **Post date:** [August 3, 2020, 11:18am UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475/4 "2020-08-03T11:18:34Z")
I have fixed this issue by changing the order of the cert chain. It will be like leaf -\> intermediate -\> root. Thanks @TimV for you help. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [August 5, 2020, 4:27am UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475/5 "2020-08-05T04:27:56Z")
Sorry, that was my mistake - I'll blame it on Monday. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 2, 2020, 4:28am UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475/6 "2020-09-02T04:28:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.