# Exception Bad certificate when connecting to ES8 from Tomcat10

**URL:** <https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 19, 2024, 8:11am UTC](https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688 "2024-03-19T08:11:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Irgnar](https://avatars.discourse-cdn.com/v4/letter/i/65b543/32.png) [@Irgnar](https://discuss.elastic.co/u/Irgnar)\
**Post date:** [March 19, 2024, 8:11am UTC](https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688/1 "2024-03-19T08:11:29Z")

</div>

Hello, i'm migratiing an app from SpringBoot2.7.5 / Tomcat9 / ES7 to SpringBoot 3 / Tomcat10 / ES8, and i have this exception on the tomcat side :

```auto
Caused by: java.lang.RuntimeException: Received fatal alert: bad_certificate
        at org.springframework.data.elasticsearch.client.elc.ElasticsearchExceptionTranslator.translateException(ElasticsearchExceptionTranslator.java:63)
        ... 109 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at org.elasticsearch.client.RestClient.extractAndWrapCause(RestClient.java:925)
        at org.elasticsearch.client.RestClient.performRequest(RestClient.java:300)
        at org.elasticsearch.client.RestClient.performRequest(RestClient.java:288)
        at co.elastic.clients.transport.rest_client.RestClientHttpClient.performRequest(RestClientHttpClient.java:91)
        at co.elastic.clients.transport.ElasticsearchTransportBase.performRequest(ElasticsearchTransportBase.java:144)
        at co.elastic.clients.elasticsearch.indices.ElasticsearchIndicesClient.exists(ElasticsearchIndicesClient.java:655)
        at org.springframework.data.elasticsearch.client.elc.IndicesTemplate.lambda$doExists$2(IndicesTemplate.java:177)
        at org.springframework.data.elasticsearch.client.elc.ChildTemplate.execute(ChildTemplate.java:71)
        ... 108 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)

```

I have created a new certificate for ES :

```auto
openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout elastic_key_2024.pem -out elastic_cert_2024.pem

```

The HTTP configuration in elasticsearch.yml (only one node)

```auto
# HTTP
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.client_authentication: required
xpack.security.http.ssl.key: /var/lib/elasticsearch-8.11.4/config/certificats/elastic_key_2024.pem
xpack.security.http.ssl.certificate: /var/lib/elasticsearch-8.11.4/config/certificats/elastic_cert_2024.pem
xpack.security.http.ssl.certificate_authorities: ["/var/lib/elasticsearch-8.11.4/config/certificats/elastic_cert_2024.pem","/var/lib/elasticsearch-8.11.4/config/certificats/deca-app-tomcat_cert_2024.pem"]

```

The deca-app-tomcat\_cert\_2024.pem has been generated with the tomcat keystore (key running up to 2030+) et I also added the elastic\_cert\_2024.pem to the tomcat truststore. Tomcat is started with the trustore/keystore options.

I don't know what i'm doing wrong here.

---

<div class="post-metadata">

**Author:** ![Irgnar](https://avatars.discourse-cdn.com/v4/letter/i/65b543/32.png) [@Irgnar](https://discuss.elastic.co/u/Irgnar)\
**Post date:** [March 19, 2024, 10:01am UTC](https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688/2 "2024-03-19T10:01:03Z")

</div>

Logs on ES side :

```auto
[2024-03-19T10:51:24,177][WARN][o.e.h.AbstractHttpServerTransport] [sia-node-1] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/172.20.92.154:9400, remoteAddress=/172.20.92.155:55742}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty client certificate chain
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:499) ~[?:?]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]
        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) ~[?:?]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]
        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[?:?]
        at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]
        at java.lang.Thread.run(Thread.java:1583) ~[?:?]
Caused by: javax.net.ssl.SSLHandshakeException: Empty client certificate chain
        at sun.security.ssl.Alert.createSSLException(Alert.java:130) ~[?:?]
        at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:365) ~[?:?]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:321) ~[?:?]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:312) ~[?:?]
        at sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1157) ~[?:?]
        at sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1144) ~[?:?]
        at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:393) ~[?:?]
        at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:476) ~[?:?]
        at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1273) ~[?:?]
        at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260) ~[?:?]
        at java.security.AccessController.doPrivileged(AccessController.java:714) ~[?:?]
        at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1205) ~[?:?]
        at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1559) ~[?:?]
        at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1405) ~[?:?]
        at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1246) ~[?:?]
        at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1295) ~[?:?]
        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[?:?]
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[?:?]
        ... 16 more

```

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 20, 2024, 5:16am UTC](https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688/3 "2024-03-20T05:16:42Z")

</div>

The issue here is that your ES node requires client certificates

> [@Irgnar](#):
>
> `xpack.security.http.ssl.client_authentication: required`

But your app in Tomcat didn't provide one:

> [@Irgnar](#):
>
> `Caused by: javax.net.ssl.SSLHandshakeException: Empty client certificate chain`

There are a number of reasons why that might be the case. But it's hard to know which.  
My guess is that Tomcat doesn't think any of its certificates match the CAs that Elasticsearch will accept.

I would recommend you try and test using `curl` and/or `openssl s_client` to verify your configuration, and then try and work out what you need to do to get the Tomcat app to do the right thing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2024, 5:17am UTC](https://discuss.elastic.co/t/exception-bad-certificate-when-connecting-to-es8-from-tomcat10/355688/4 "2024-04-17T05:17:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.