# Get https://localhost:9200/\_xpack/security/\_authenticate?pretty: x509: certificate signed by unknown authority
**URL:** https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [June 11, 2019, 5:40pm UTC](https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256 "2019-06-11T17:40:29Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@krithb](https://discuss.elastic.co/u/krithb)
#### Post date: [June 11, 2019, 5:40pm UTC](https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256/1 "2019-06-11T17:40:30Z")
Hi I am getting below error
"x509: certificate signed by unknown authority " when running the program.
Steps I have followed to generate
**server-certificates** :
openssl req -x509 -newkey rsa:4096 -keyout server\_key.pem -out server\_cert.pem -nodes -days 365 -subj "/CN=localhost/O=Client\ Certificate\ Demo"
openssl pkcs12 -export -out Cert.p12 -in cert.pem -inkey key.pem
**client-certificates**
openssl req -newkey rsa:4096 -keyout alice\_key.pem -out alice\_csr.pem -nodes -days 365 -subj "/CN=Alice"
openssl x509 -req -in alice\_csr.pem -CA server\_cert.pem -CAkey server\_key.pem -out alice\_cert.pem -set\_serial 01 -days 365
Please help me to resolve the error
---
### Author:  [@krithb](https://discuss.elastic.co/u/krithb)
#### Post date: [June 11, 2019, 5:42pm UTC](https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256/2 "2019-06-11T17:42:00Z")
```
/0:0:0:0:0:0:0:1:59807]
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLException: Received fatal alert: bad_certificate
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:405) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:372) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:355) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.ssl.SslHandler.channelInactive(SslHandler.java:1054) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:231) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:224) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelInactive(DefaultChannelPipeline.java:1429) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:231) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelInactive(DefaultChannelPipeline.java:947) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.AbstractChannel$AbstractUnsafe$8.run(AbstractChannel.java:826) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163) [netty-common-4.1.32.Final.jar:4.1.32.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:404) [netty-common-4.1.32.Final.jar:4.1.32.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:474) [netty-transport-4.1.32.Final.jar:4.1.32.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:909) [netty-common-4.1.32.Final.jar:4.1.32.Final]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_45]
Caused by: javax.net.ssl.SSLException: Received fatal alert: bad_certificate
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208) ~[?:1.8.0_45]
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666) ~[?:1.8.0_45]
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634) ~[?:1.8.0_45]
at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800) ~[?:1.8.0_45]
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083) ~[?:1.8.0_45]
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907) ~[?:1.8.0_45]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) ~[?:1.8.0_45]
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[?:1.8.0_45]
at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:295) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1301) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1203) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1247) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final]
... 17 more
```
PFA elasticsearch logs generated
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 12, 2019, 6:30am UTC](https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256/3 "2019-06-12T06:30:38Z")
I'm sorry, it's too hard to follow what you're trying to do, and why it's failing.
Can you start at the beginning and describe
- what you're trying to achieve
- what steps you've tried
- what outcome you expected
- how it failed
* * *
> [@krithb](#):
>
> "x509: certificate signed by unknown authority " when running the program.
What program do you mean? How did you run it?
> [@krithb](#):
>
> openssl pkcs12 -export -out Cert.p12 -in cert.pem -inkey key.pem
Where did `cert.pem` and `key.pem` come from?
> [@krithb](#):
>
> Caused by: javax.net.ssl.SSLException: Received fatal alert: bad\_certificate
This means that your client (`curl` perhaps?) didn't like the certificate that Elasticsearch provided. Since you haven't provided any details about your elasticsearch configuration, or what client is trying to connect, it's impossible for me to diagnose the cause of this problem.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 10, 2019, 6:30am UTC](https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256/4 "2019-07-10T06:30:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.