# Failed to ADD xpack.security.http.ssl.enabled **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 13, 2018, 9:10pm UTC](https://discuss.elastic.co/t/failed-to-add-xpack-security-http-ssl-enabled/152360 "2018-10-13T21:10:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rmadoori](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Post date:** [October 13, 2018, 9:10pm UTC](https://discuss.elastic.co/t/failed-to-add-xpack-security-http-ssl-enabled/152360/1 "2018-10-13T21:10:56Z")
Hi , I am trying to make elastic search http endpoints and HTTPS endpoints I generated certs from cert manager [2018-10-13T21:07:50,096][DEBUG][o.e.x.c.s.SSLService] [es-coordinating] using ssl settings [SSLConfiguration{keyConfig=[NONE], trustConfig=JDK trusted certs], cipherSuites=[[TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA]], supportedProtocols=[[TLSv1.2, TLSv1.1, TLSv1]], sslClientAuth=[REQUIRED], verificationMode=[FULL]}] [2018-10-13T21:07:50,202][WARN][o.e.b.ElasticsearchUncaughtExceptionHandler] [es-coordinating] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.3.0.jar:6.3.0] at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.3.0.jar:6.3.0] Caused by: java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin] Caused by: java.lang.IllegalArgumentException: Setting [secure\_key\_passphrase] is a secure setting and must be stored inside the Elasticsearch keystore, but was found inside elasticsearch.yml at org.elasticsearch.common.settings.SecureSetting.get(SecureSetting.java:88) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.xpack.core.ssl.CertUtils.createKeyConfig(CertUtils.java:195) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLConfiguration.createKeyConfig(SSLConfiguration.java:187) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLConfiguration.\(SSLConfiguration.java:70) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$0(SSLService.java:453) ~[?:?] at java.util.ArrayList.forEach(ArrayList.java:1378) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:452) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.\(SSLService.java:79) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.\(XPackPlugin.java:134) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:488) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:692) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:643) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:557) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.plugins.PluginsService.\(PluginsService.java:162) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.node.Node.\(Node.java:311) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.node.Node.\(Node.java:252) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Bootstrap$5.\(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.3.0.jar:6.3.0] Caused by: java.lang.IllegalArgumentException: Setting [secure\_key\_passphrase] is a secure setting and must be stored inside the Elasticsearch keystore, but was found inside elasticsearch.yml at org.elasticsearch.common.settings.SecureSetting.get(SecureSetting.java:88) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.xpack.core.ssl.CertUtils.createKeyConfig(CertUtils.java:195) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLConfiguration.createKeyConfig(SSLConfiguration.java:187) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLConfiguration.\(SSLConfiguration.java:70) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSSLConfigurations$0(SSLService.java:453) ~[?:?] at java.util.ArrayList.forEach(ArrayList.java:1378) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:452) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.\(SSLService.java:79) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.\(XPackPlugin.java:134) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:488) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:692) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:643) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:557) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.plugins.PluginsService.\(PluginsService.java:162) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.node.Node.\(Node.java:311) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.node.Node.\(Node.java:252) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Bootstrap$5.\(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.3.0.jar:6.3.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.3.0.jar:6.3.0] ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [October 13, 2018, 10:42pm UTC](https://discuss.elastic.co/t/failed-to-add-xpack-security-http-ssl-enabled/152360/2 "2018-10-13T22:42:41Z")
Hi @rmadoori, This > [@rmadoori](#): > > Caused by: java.lang.IllegalArgumentException: Setting [secure\_key\_passphrase] is a secure setting and must be stored inside the Elasticsearch keystore, but was found inside elasticsearch.yml leads me thinking that you have not used [Secure settings](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/secure-settings.html#secure-settings) for at least one `*.ssl.secure_key_passphrase` setting, and instead you have specified it inside the `elasticsearch.yml` config file. For example, to set the passphrase for the private key used for [https communication](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/configuring-tls.html#tls-http) run `bin/elasticsearch-keystore add xpack.security.http.ssl.secure_key_passphrase` in ES home. ---
**Author:** ![rmadoori](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Post date:** [October 14, 2018, 3:42am UTC](https://discuss.elastic.co/t/failed-to-add-xpack-security-http-ssl-enabled/152360/3 "2018-10-14T03:42:45Z")
Hi, ##### I am Running cluster on kubernetes using docker containers Thanks For responsing i have removed passphrase for my certs and it worked . Next thing is i am running in cluster mode i have master-node data-node coordinating-node how to make sure that they all communicate cause previously since its http i dint have to do any thing . but now since its https do i need to add the certs accross all nodes for communication ? My elasticsearch.yaml for coordinating node looks like this ``` `elasticsearch.yml: | cluster.name: es-cluster node.master: false node.data: false node.name: es-coordinating node.ingest: false network.host: 0.0.0.0 http.port: 9200 discovery.zen.minimum_master_nodes: 1 ``` discovery.zen.ping.unicast.hosts: ["es-coordinating","es-master","es-data"] node.ml: false xpack.security.enabled: true xpack.ml.enabled: true xpack.security.http.ssl.enabled: true xpack.security.http.ssl.verification\_mode: certificate xpack.security.http.ssl.key: /usr/share/elasticsearch/data/certs/tls.key xpack.security.http.ssl.certificate: /usr/share/elasticsearch/data/certs/tls.crt` ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [October 14, 2018, 12:40pm UTC](https://discuss.elastic.co/t/failed-to-add-xpack-security-http-ssl-enabled/152360/4 "2018-10-14T12:40:08Z")
Hi @rmadoori, Have you checked the docs for the Elasticsearch docker container about TLS encryption? [configuring-tls-docker](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls-docker.html) It creates a two node cluster. You can extend that configuration to your needs. The example that I've pointed you at has a "fire-once" container configuration that is generating the certificates. The TLS configuration that is used is _certificate validation mode_. Moreover, I see from the node configuration that you are sharing that you're only setting TLS for the HTTP layer. From the [Configurting Security](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html#configuring-security) guide, at point 4, TLS is required only for the [internode-communication](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html#tls-transport) . You don't have such settings in your config file. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 11, 2018, 12:40pm UTC](https://discuss.elastic.co/t/failed-to-add-xpack-security-http-ssl-enabled/152360/5 "2018-11-11T12:40:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.