# ES cloud - CA certificates

**URL:** <https://discuss.elastic.co/t/es-cloud-ca-certificates/336085>\
**Category:** Elasticsearch\
**Created:** [June 15, 2023, 11:22am UTC](https://discuss.elastic.co/t/es-cloud-ca-certificates/336085 "2023-06-15T11:22:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leonid\_fayngold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leonid_fayngold/32/122289_2.png) [@leonid\_fayngold](https://discuss.elastic.co/u/leonid_fayngold)\
**Post date:** [June 15, 2023, 11:22am UTC](https://discuss.elastic.co/t/es-cloud-ca-certificates/336085/1 "2023-06-15T11:22:38Z")

</div>

Hi,  
Our team is moving from ES on prem to ES on cloud.  
I have created ES instance in Azure and I want to send some requests to my Elasticsearch endpoint.  
I have tried to send add user request however the request is rejected on cert issue.  
I am sending my requests using java API/curl from a remote computer in my organization , I have downloaded the CA cert from cloud elastic management tool and  
added this cert to my SSL context, however my request is rejected with the following Exception:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I am wondering where can I get valid CA cert to add into my keystore and connect to the endpoint ? can you advise ?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 15, 2023, 1:48pm UTC](https://discuss.elastic.co/t/es-cloud-ca-certificates/336085/2 "2023-06-15T13:48:39Z")

</div>

Have you tried to simply do a `curl` request to make sure

The Elastic Cloud CAs are publicly signed so you should not need the CA locally

Can you try

`curl -v -u elastic https://escloudendpoint`

You don't need a port

Make sure you get the right endpoint.

Let's see if that works first then work on the next problem

But if you still want them  
Go To Elastic Cloud  
Go to your Deployment  
Go to Security and you can download the CA for that Deployment

 ![Screenshot 2023-06-15 at 7.37.29 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b52cdf5868b3da7ec09cded07c9d10b9400eaebb.png)  
 ![Screenshot 2023-06-15 at 7.37.37 AM](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cd67b5b1569ca246c4342c411da8fd8b821c061c.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2023, 1:49pm UTC](https://discuss.elastic.co/t/es-cloud-ca-certificates/336085/3 "2023-07-13T13:49:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.