# ES 7.8 X-Pack not returning whole cert chain root ca, intermediate and server cert **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [August 2, 2020, 7:27pm UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475 "2020-08-02T19:27:24Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![mankuuuuu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mankuuuuu/32/73208_2.png) [@mankuuuuu](https://discuss.elastic.co/u/mankuuuuu)\ **Post date:** [August 3, 2020, 6:19am UTC](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475/3 "2020-08-03T06:19:08Z")
Thank you for your quick reply @TimV I have tried what you have mentioned in your comment but I am getting ```auto Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL KeyManagerFactory at org.elasticsearch.xpack.core.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:73) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:438) ~[?:?] at java.util.HashMap.computeIfAbsent(HashMap.java:1225) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$5(SSLService.java:526) ~[?:?] at java.util.HashMap.forEach(HashMap.java:1425) ~[?:?] at java.util.Collections$UnmodifiableMap.forEach(Collections.java:1521) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:524) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:142) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:397) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:263) ~[?:?] at org.elasticsearch.node.Node.lambda$new$11(Node.java:484) ~[elasticsearch-7.8.0.jar:7.8.0] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:271) ~[?:?] at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1624) ~[?:?] at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?] at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?] at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?] at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578) ~[?:?] at org.elasticsearch.node.Node.(Node.java:488) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.node.Node.(Node.java:266) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:227) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:227) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:393) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.8.0.jar:7.8.0] ... 6 more Caused by: java.security.KeyStoreException: Certificate chain is not valid at sun.security.pkcs12.PKCS12KeyStore.setKeyEntry(PKCS12KeyStore.java:646) ~[?:?] at sun.security.pkcs12.PKCS12KeyStore.engineSetKeyEntry(PKCS12KeyStore.java:596) ~[?:?] at sun.security.util.KeyStoreDelegator.engineSetKeyEntry(KeyStoreDelegator.java:111) ~[?:?] at java.security.KeyStore.setKeyEntry(KeyStore.java:1167) ~[?:?] at org.elasticsearch.xpack.core.ssl.CertParsingUtils.getKeyStore(CertParsingUtils.java:183) ~[?:?] at org.elasticsearch.xpack.core.ssl.CertParsingUtils.keyManager(CertParsingUtils.java:174) ~[?:?] at org.elasticsearch.xpack.core.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:71) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:438) ~[?:?] at java.util.HashMap.computeIfAbsent(HashMap.java:1225) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$5(SSLService.java:526) ~[?:?] at java.util.HashMap.forEach(HashMap.java:1425) ~[?:?] at java.util.Collections$UnmodifiableMap.forEach(Collections.java:1521) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:524) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:142) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:397) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.createComponents(XPackPlugin.java:263) ~[?:?] at org.elasticsearch.node.Node.lambda$new$11(Node.java:484) ~[elasticsearch-7.8.0.jar:7.8.0] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:271) ~[?:?] at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1624) ~[?:?] at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?] at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?] at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?] at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578) ~[?:?] at org.elasticsearch.node.Node.(Node.java:488) ~[elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.node.Node.(Node.java:266) ~[elasticsearch-7.8.0.jar:7.8.0] ``` My root ca and intermediate is Digicert and I downloaded them from here [https://www.digicert.com/kb/digicert-root-certificates.htm#roots](https://www.digicert.com/kb/digicert-root-certificates.htm#roots) [https://www.digicert.com/kb/digicert-root-certificates.htm#intermediates](https://www.digicert.com/kb/digicert-root-certificates.htm#intermediates) Verified chain - ```auto openssl verify -CAfile DigiCertHighAssuranceEVRootCA.crt.pem -untrusted DigiCertSHA2HighAssuranceServerCA.crt.pem azara.crt domain.crt: OK ``` and my order is root -\> intermediates -\> server.crt passing this complete bundle in the configuration throwing error of invalid certificate chain. Is anything I am doing wrong here ? --- _[View the full topic](https://discuss.elastic.co/t/es-7-8-x-pack-not-returning-whole-cert-chain-root-ca-intermediate-and-server-cert/243475)._