Failed to start elasticsearch|| ssl error

Elastic Stack Elasticsearch
1

Unable to start elasticsearch

[2025-08-20T17:16:58,661][ERROR][o.e.b.Elasticsearch      ] [vfralapelkprd01.canoninf.net] fatal exception while booting Elasticsearchorg.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.http.ssl] - cannot read configured [PKCS12] keystore (as a truststore) [/etc/elasticsearch/certs/http.p12] - this is usually caused by an incorrect password; (a keystore password was provided)at org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSslConfigurations$11(SSLService.java:622) ~[?:?]at java.util.HashMap.forEach(HashMap.java:1430) ~[?:?]
2

Hi @sreya_14

If you would like help you are going to need to provide a lot more information.

The error message is self explanatory...

But why is the hard part
Often that is caused by the elasticsearch.keystore not being found because it was not properly populated or can not be found because elasticsearch is not bein started properly

  • What Version are you running
  • Exactly How did you install / configure?
  • How did you create the certs?
  • What did you change if anything?
  • Exactly How did you start?
3

Hi Stephen,

Thanks for responding .PFB the points

What Version are you running

  • Exactly How did you install / configure?–> I have installed the stack using RPM

  • How did you create the certs?using the elasticsearch-certutil

  • What did you change if anything? It is newly created

  • Exactly How did you start?using sudo systemctl

This is fresh installation of 8.18 v for our new OCI prod and we are using self signed certificates because the es servers are internal .Please suggest and also let me know if any more information is needed .

4

The error says it cannot open the cert http.p12 because it's password protected

So when you created that cer, did you provide a password? If so, you need to put that password in the elastic.keystore with the proper settings

Or you need to create a cert without a password

Add the password for your private key to the secure settings in Elasticsearch.

./bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password
5

Yes i have added password for this .How do I put this password now ? Can you tell what can be done from this point of error ?Do i need to generate the certificate again ? or can be solved from this point

6

run this

elasticsearch-keystore show xpack.security.http.ssl.keystore.secure_password

If it has an error, then it probably means that you missed the step that @stephenb has advised you to take. Go back and follow his instructions.

If it worked, then copy the output and paste it into

keytool -list -keystore /etc/elasticsearch/certs/http.p12 -storepass "PASTE_PASSWORD_HERE"

If the password is correct it will list the keystore entries, if it is incorrect it will fail with

keytool error: java.io.IOException: keystore password was incorrect