# Getting Authentication Exception even CA cert is provided (python)

**URL:** <https://discuss.elastic.co/t/getting-authentication-exception-even-ca-cert-is-provided-python/311360>\
**Category:** Elasticsearch\
**Tags:** language-clients\
**Created:** [August 4, 2022, 4:04am UTC](https://discuss.elastic.co/t/getting-authentication-exception-even-ca-cert-is-provided-python/311360 "2022-08-04T04:04:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brian\_Chan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brian_chan/32/100648_2.png) [@Brian\_Chan](https://discuss.elastic.co/u/Brian_Chan)\
**Post date:** [August 4, 2022, 4:04am UTC](https://discuss.elastic.co/t/getting-authentication-exception-even-ca-cert-is-provided-python/311360/1 "2022-08-04T04:04:45Z")

</div>

Hi everyone, I have a self-managed elasticsearch 8.3.0 cluster with security enabled.

When using python client, even I included the CA cert, I still get the error: AuthenticationException(401, 'security\_exception', 'missing authentication credentials for REST request [/]')

My code is here:

```auto
from elasticsearch import Elasticsearch, RequestsHttpConnection
from ssl import create_default_context

context = create_default_context(cafile='elasticsearch-ca.pem')
context.check_hostname = False

node = ['https://192.168.5.41:9200', 'https://192.168.5.42:9200', 'https://192.168.5.43:9200']

es_connection = Elasticsearch(node, basic_auth=("connector", "connector"), verify_certs=False, ssl_context=context)

```

I would be grateful if someone can help me with this issue. Thanks a lot.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 4, 2022, 5:41am UTC](https://discuss.elastic.co/t/getting-authentication-exception-even-ca-cert-is-provided-python/311360/2 "2022-08-04T05:41:12Z")

</div>

Hi @Brian_Chan Welcome to the community.

Have you tried the method shown in the docs [here](https://www.elastic.co/guide/en/elasticsearch/client/python-api/current/connecting.html#connect-self-managed-new)

Authentication error typically means you invalid username and or password.

Also I suspect you may need a full path to the cert.

And if you did a default install You're using the wrong cert. You want to use the CA that was generated see below

```auto
from elasticsearch import Elasticsearch

# Password for the 'elastic' user generated by Elasticsearch
ELASTIC_PASSWORD = "<password>"

# Create the client instance
client = Elasticsearch(
    "https://localhost:9200",
    ca_certs="/path/to/http_ca.crt",
    basic_auth=("elastic", ELASTIC_PASSWORD)
)

# Successful response!
client.info()

```

---

<div class="post-metadata">

**Author:** ![Brian\_Chan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brian_chan/32/100648_2.png) [@Brian\_Chan](https://discuss.elastic.co/u/Brian_Chan)\
**Post date:** [August 4, 2022, 6:07am UTC](https://discuss.elastic.co/t/getting-authentication-exception-even-ca-cert-is-provided-python/311360/3 "2022-08-04T06:07:10Z")

</div>

Hi @stephenb, thank you for your responds.

I can successfully connect to my cluster now. I did two actions: 1. upgrade my python library which match my elasticsearch version. 2. authorize my user account to superuser.

May I ask is it really necessary to give the user all the permission in order to use the python client?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 4, 2022, 1:50pm UTC](https://discuss.elastic.co/t/getting-authentication-exception-even-ca-cert-is-provided-python/311360/4 "2022-08-04T13:50:31Z")

</div>

> [@Brian\_Chan](#):
>
> May I ask is it really necessary to give the user all the permission in order to use the python client?

No most our samples show the `elastic` user for consistency.

You can create a user and a role with the specific permissions that you want and use it.

Just read up on users and roles and set it up And you will be fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2022, 1:51pm UTC](https://discuss.elastic.co/t/getting-authentication-exception-even-ca-cert-is-provided-python/311360/5 "2022-09-01T13:51:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.