# Getting "bad\_certificate" with certs that I've generated

**URL:** <https://discuss.elastic.co/t/getting-bad-certificate-with-certs-that-ive-generated/122097>\
**Category:** Elasticsearch\
**Created:** [March 1, 2018, 2:34pm UTC](https://discuss.elastic.co/t/getting-bad-certificate-with-certs-that-ive-generated/122097 "2018-03-01T14:34:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sbu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sbu/32/27718_2.png) [@sbu](https://discuss.elastic.co/u/sbu)\
**Post date:** [March 1, 2018, 2:34pm UTC](https://discuss.elastic.co/t/getting-bad-certificate-with-certs-that-ive-generated/122097/1 "2018-03-01T14:34:18Z")

</div>

I've set up a CA and generated my own cert using the following commands:-

**Create root private CA key**  
`winpty openssl genrsa -aes256 -out private/ca.key.pem 4096`

**Create root cert.**  
`winpty openssl req -config openssl-ca.cnf -key private/ca.key.pem -new -x509 -days 7300 -sha256 -extensions v3_ca -out certs/ca.cert.pem`

**Generate CSR**  
`openssl req -newkey rsa:2048 -out ukselastic.csr -key private.key -sha256 -days 730 -outform PEM`

**Sign the CSR with the CA.**  
[https://www.elastic.co/guide/en/shield/shield-1.2/\_create\_a\_ca\_certificate.html](https://www.elastic.co/guide/en/shield/shield-1.2/_create_a_ca_certificate.html)  
`winpty openssl x509 -req -days 730 -CA certs/ca.cert.pem -CAkey private/ca.key.pem -CAcreateserial -CAserial serial -in ukselastic.csr -out ukselastic.pem`  
(actually from [https://stackoverflow.com/questions/32072668/openssl-sign-https-client-certificate-with-ca](https://stackoverflow.com/questions/32072668/openssl-sign-https-client-certificate-with-ca) )

However when I copy across the ukselastic.pem and the private.key files to the server and amend the config to look at them, ES refuses to start and comes back with

> <https://gist.github.com/sbutt/90b60001b4a9d22283a9e4c8839fe708>

which contains "unable to find valid certification path to requested target". The strange thing is I'm using this exact same configuration on the first node, and it start up just fine. It's even using the same certs, as they are SAN certs which include all the names for the nodes. Even if there was a problem with the SAN cert, I would have expected it to fail on both nodes.

I guess I'm barking up the wrong tree, but I really can't see what's wrong with my config.

Any suggestions?

EDIT: After posting this I wondered if it's an ordering thing, so I tried starting node1 and then node0. Lo and behold, node1 starts just fine, but as soon as I start node 0 I get the errors. Not sure if this helps me at all, but it's another fact to consider.

Thanks,

Steve

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2018, 2:34pm UTC](https://discuss.elastic.co/t/getting-bad-certificate-with-certs-that-ive-generated/122097/2 "2018-03-29T14:34:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.