# Failed to load SSL configuration \[xpack.security.transport.ssl\] - the truststore \[/usr/share/elasticsearch/ssl/qa.pfx\] does not contain any trusted certificate entries **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, docker\ **Created:** [September 15, 2023, 11:57am UTC](https://discuss.elastic.co/t/failed-to-load-ssl-configuration-xpack-security-transport-ssl-the-truststore-usr-share-elasticsearch-ssl-qa-pfx-does-not-contain-any-trusted-certificate-entries/343138 "2023-09-15T11:57:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Anushree](https://avatars.discourse-cdn.com/v4/letter/a/e0b2c6/32.png) [@Anushree](https://discuss.elastic.co/u/Anushree)\ **Post date:** [September 15, 2023, 11:57am UTC](https://discuss.elastic.co/t/failed-to-load-ssl-configuration-xpack-security-transport-ssl-the-truststore-usr-share-elasticsearch-ssl-qa-pfx-does-not-contain-any-trusted-certificate-entries/343138/1 "2023-09-15T11:57:34Z")
Hello, I encountered an SSL certificate trust issue when attempting to upgrade a single-node Elasticsearch instance from version 7.17 to 8.0, same certificate was working on 7.17. I am using a valid certificate chain provided by my organization, which includes the private key and is in the .pfx format. I have also included my docker-compose.yml and Dockerfile for reference. What steps should I take to resolve this SSL certificate trust issue? ```auto **2023-09-06T11:06:18.896781000Z uncaught exception in thread [main]** **2023-09-06T11:06:18.897057000Z org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl] - the truststore [/usr/share/elasticsearch/ssl/qa.pfx] does not contain any trusted certificate entries** **2023-09-06T11:06:18.897315000Z Likely root cause: org.elasticsearch.common.ssl.SslConfigException: the truststore [/usr/share/elasticsearch/ssl/qa.pfx] does not contain any trusted certificate entries** **2023-09-06T11:06:18.897573000Z at org.elasticsearch.common.ssl.StoreTrustConfig.checkTrustStore(StoreTrustConfig.java:135)** ``` Elasticsearch Dockerfile ```auto FROM docker.elastic.co/elasticsearch/elasticsearch:8.0.1 RUN elasticsearch-plugin install repository-azure --batch && \ elasticsearch-keystore create RUN mkdir -p /usr/share/elasticsearch/ssl COPY ["CERT_PATH", "/usr/share/elasticsearch/ssl/"] RUN echo "DEFAULT_STORAGE_ACCOUNT_NAME" | elasticsearch-keystore add azure.client.default.account -xf && \ echo "DEFAULT_STORAGE_ACCOUNT_KEY" | elasticsearch-keystore add azure.client.default.key RUN echo "SECONDARY_STORAGE_ACCOUNT_NAME" | elasticsearch-keystore add azure.client.secondary.account -xf && \ echo "SECONDARY_STORAGE_ACCOUNT_KEY" | elasticsearch-keystore add azure.client.secondary.key -xf RUN echo "ADMIN_PASSWORD" | elasticsearch-keystore add bootstrap.password -xf && \ echo "CERT_PASS" | elasticsearch-keystore add xpack.security.http.ssl.truststore.secure_password -xf && \ echo "CERT_PASS" | elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password -xf && \ echo "ES_TRANSPORT_SSL_PASSWORD" | elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password -xf && \ echo "ES_TRANSPORT_SSL_PASSWORD" | elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password -xf USER root RUN apt-get update && apt-get install openssl wget -y RUN echo "CERT_PASS" | openssl pkcs12 -in /usr/share/elasticsearch/ssl/qa.pfx -out /usr/share/elasticsearch/ssl/elasticsearch-http-ca.crt -cacerts -nokeys -chain -passin stdin RUN echo "CERT_PASS" | openssl pkcs12 -in /usr/share/elasticsearch/ssl/qa.pfx -nocerts -out /usr/share/elasticsearch/ssl/kb-key.pem -nodes -passin stdin RUN echo "CERT_PASS" | openssl pkcs12 -in /usr/share/elasticsearch/ssl/qa.pfx -out /usr/share/elasticsearch/ssl/kb-cert.pem -chain -passin stdin -passout pass:"PEM_PASS" RUN chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/ssl/elasticsearch-http-ca.crt && \ chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/ssl/kb-key.pem && \ chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/ssl/kb-cert.pem RUN apt-get update && apt-get install wget RUN if [-z "MICROSCANNER_TOKEN"]; then echo "MICROSCANNER_TOKEN not set using --build-arg MICROSCANNER_TOKEN="; exit 1; else : ; fi && \ wget -O /microscanner https://get.aquasec.com/microscanner && \ chmod +x /microscanner && \ ["MICROSCANNER_SHA /microscanner" = "$(sha256sum /microscanner)"] && \ /microscanner --continue-on-failure MICROSCANNER_TOKEN && \ rm -rf /microscanner USER elasticsearch ``` Docker-compose.yml ```auto version: '2' services: es-0: image: ACR_ElasticSearch_Image_Path container_name: elasticsearch-0 restart: always network_mode: host environment: - cluster.name=es-0 - node.name=es-0 - path.logs=/var/log - path.data=/usr/share/elasticsearch/data - discovery.seed_hosts=127.0.0.1 - cluster.initial_master_nodes=es-0 - network.host=_site_,_local_ - node.roles=master,data - ELASTIC_PASSWORD="ELASTIC_PASSWORD" - node.attr.fault_domain=0 - node.attr.update_domain=0 - cluster.routing.allocation.awareness.attributes=fault_domain,update_domain - cluster.routing.allocation.disk.watermark.enable_for_single_data_node=true - azure.client.default.endpoint_suffix=core.windows.net - xpack.security.enabled=true - path.repo=/usr/share/ - bootstrap.memory_lock=true - xpack.security.http.ssl.enabled=true - xpack.security.http.ssl.keystore.path=/usr/share/elasticsearch/ssl/qa.pfx - xpack.security.http.ssl.truststore.path=/usr/share/elasticsearch/ssl/qa.pfx - xpack.security.transport.ssl.enabled=true - xpack.security.transport.ssl.verification_mode=certificate - xpack.security.transport.ssl.truststore.type=PKCS12 - xpack.security.transport.ssl.keystore.type=PKCS12 - xpack.security.transport.ssl.keystore.path=/usr/share/elasticsearch/ssl/qa.pfx - xpack.security.transport.ssl.truststore.path=/usr/share/elasticsearch/ssl/qa.pfx - "ES_JAVA_OPTS=-Xms15000m -Xmx15000m" - indices.requests.cache.size=10% volumes: - data01:/usr/share/elasticsearch/data ulimits: memlock: soft: -1 hard: -1 ports: - 9200:9200 - 9300:9300 volumes: data01: driver: local ``` ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [September 15, 2023, 12:40pm UTC](https://discuss.elastic.co/t/failed-to-load-ssl-configuration-xpack-security-transport-ssl-the-truststore-usr-share-elasticsearch-ssl-qa-pfx-does-not-contain-any-trusted-certificate-entries/343138/2 "2023-09-15T12:40:38Z")
Your pfx file is a keystore, not a truststore. 7.x would try to work around that configuration error, but it would sometimes cause difficult to diagnose issues, so 8.x no longer does that. In order to be a valid truststore, a PKCS#12 file must contain explicit trusted certificate entries, your file does not. My recommendation to resolve your issue is to get a copy of the organisation CA in PEM format and configure it as the `xpack.security.transport.ssl.certificate_authorities` However, we always recommend using a dedicated CA to secure the transport port rather than your organisation CA. ---
**Author:** ![Anushree](https://avatars.discourse-cdn.com/v4/letter/a/e0b2c6/32.png) [@Anushree](https://discuss.elastic.co/u/Anushree)\ **Post date:** [September 20, 2023, 12:10pm UTC](https://discuss.elastic.co/t/failed-to-load-ssl-configuration-xpack-security-transport-ssl-the-truststore-usr-share-elasticsearch-ssl-qa-pfx-does-not-contain-any-trusted-certificate-entries/343138/3 "2023-09-20T12:10:08Z")
Thank you @TimV , issue got resolved configuring CA in PEM format ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 18, 2023, 12:10pm UTC](https://discuss.elastic.co/t/failed-to-load-ssl-configuration-xpack-security-transport-ssl-the-truststore-usr-share-elasticsearch-ssl-qa-pfx-does-not-contain-any-trusted-certificate-entries/343138/4 "2023-10-18T12:10:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.