# Getting invalid SSL configuration Error while setting up password for default user **URL:** \ **Category:** Elastic Search\ **Created:** [December 18, 2024, 12:05pm UTC](https://discuss.elastic.co/t/getting-invalid-ssl-configuration-error-while-setting-up-password-for-default-user/372159 "2024-12-18T12:05:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![amit\_tandel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amit_tandel/32/140143_2.png) [@amit\_tandel](https://discuss.elastic.co/u/amit_tandel)\ **Post date:** [December 18, 2024, 12:05pm UTC](https://discuss.elastic.co/t/getting-invalid-ssl-configuration-error-while-setting-up-password-for-default-user/372159/1 "2024-12-18T12:05:33Z")
Hello I have installed Elasticsearch v7.17.25 as we are going to use Elastic Search for indexing/search for our Alfresco system. We enabled the Elasticsearch security features and when we try to setup password for default user we get the below error: Certificate issued by the Org has DNS for LB URL, FQDN and Hostname. It does not have the IP Address. ./elasticsearch-setup-passwords interactive Error: [main] CRITICAL org.elasticsearch.deprecation.xpack.core.ssl.SSLService - invalid SSL configuration for xpack.security.transport.ssl - server ssl configuration requires a key and certificate, but these have not been configured; you must set either [xpack.security.transport.ssl.keystore.path], or both [xpack.security.transport.ssl.key] and [xpack.security.transport.ssl.certificate] 05:49:57.976 [main] WARN org.elasticsearch.common.ssl.DiagnosticTrustManager - failed to establish trust with server at [xx.xx.xx.xx]; the server provided a certificate with subject name [xyz] and fingerprint [abc123]; the certificate has subject alternative names [DNS:abc.com,DNS:FQDN,DNS:]; the certificate is issued by [xyz] but the server did not provide a copy of the issuing certificate in the certificate chain; this ssl context ([xpack.security.http.ssl]) is not configured to trust that issuer but trusts [109] other issuers java.security.cert.CertificateException: No subject alternative names matching IP address \ found at sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:160) ~[?:?] at sun.security.util.HostnameChecker.match(HostnameChecker.java:101) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:457) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:431) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:237) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132) ~[?:?] at org.elasticsearch.common.ssl.DiagnosticTrustManager.checkServerTrusted(DiagnosticTrustManager.java:83) ~[elasticsearch-ssl-config-7.17.25.jar:7.17.25] at sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1310) ~[?:?] at sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1203) ~[?:?] at sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1146) ~[?:?] at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:393) ~[?:?] at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:476) ~[?:?] at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:447) ~[?:?] at sun.security.ssl.TransportContext.dispatch(TransportContext.java:201) ~[?:?] at sun.security.ssl.SSLTransport.decode(SSLTransport.java:172) ~[?:?] at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1507) ~[?:?] at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1422) ~[?:?] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455) ~[?:?] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426) ~[?:?] at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:586) ~[?:?] at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187) ~[?:?] at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:141) ~[?:?] at org.elasticsearch.xpack.core.common.socket.SocketAccess.lambda$doPrivileged$0(SocketAccess.java:42) ~[x-pack-core-7.17.25.jar:7.17.25] at java.security.AccessController.doPrivileged(AccessController.java:571) [?:?] at org.elasticsearch.xpack.core.common.socket.SocketAccess.doPrivileged(SocketAccess.java:41) [x-pack-core-7.17.25.jar:7.17.25] at org.elasticsearch.xpack.security.authc.esnative.tool.CommandLineHttpClient.execute(CommandLineHttpClient.java:116) [x-pack-security-7.17.25.jar:7.17.25] at org.elasticsearch.xpack.security.authc.esnative.tool.SetupPasswordTool$SetupCommand.checkElasticKeystorePasswordValid(SetupPasswordTool.java:327) [x-pack-security-7.17.25.jar:7.17.25] at org.elasticsearch.xpack.security.authc.esnative.tool.SetupPasswordTool$InteractiveSetup.execute(SetupPasswordTool.java:199) [x-pack-security-7.17.25.jar:7.17.25] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) [elasticsearch-7.17.25.jar:7.17.25] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) [elasticsearch-cli-7.17.25.jar:7.17.25] at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:95) [elasticsearch-cli-7.17.25.jar:7.17.25] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) [elasticsearch-cli-7.17.25.jar:7.17.25] at org.elasticsearch.cli.Command.main(Command.java:77) [elasticsearch-cli-7.17.25.jar:7.17.25] at org.elasticsearch.xpack.security.authc.esnative.tool.SetupPasswordTool.main(SetupPasswordTool.java:128) [x-pack-security-7.17.25.jar:7.17.25] SSL connection to https://\:8443/\_security/\_authenticate?pretty failed: No subject alternative names matching IP address \ found Please check the elasticsearch SSL settings under xpack.security.http.ssl. ERROR: Failed to establish SSL connection to elasticsearch at https://\:8443/\_security/\_authenticate?pretty. Elasticsearch.yml xpack.security.enabled: true xpack.security.http.ssl.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.http.ssl.key: /apps/es/config/.key xpack.security.http.ssl.certificate: /apps/es/config/.cer Can someone please provide pointers to resolve this error? Thanks and Regards, Amit ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 18, 2024, 2:55pm UTC](https://discuss.elastic.co/t/getting-invalid-ssl-configuration-error-while-setting-up-password-for-default-user/372159/2 "2024-12-18T14:55:49Z")
Hi @amit_tandel Welcome to the community. > [@amit\_tandel](#): > > xpack.security.transport.ssl.enabled: true You have transport.ssl enabled but you do not have any certificate set for the transport. This section should look something like ```auto xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.client_authentication: required xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 ``` Perhaps you should refer it to the official documentation. > **[Configure security for the Elastic Stack | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/configuring-stack-security.html)** I also have a how-to that might help > **[howtos/basic-security-elasticsearch-pkg at master ยท bvader/howtos](https://github.com/bvader/howtos/tree/master/basic-security-elasticsearch-pkg)** > > How To Do Stuff. Contribute to bvader/howtos development by creating an account on GitHub. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 15, 2025, 2:56pm UTC](https://discuss.elastic.co/t/getting-invalid-ssl-configuration-error-while-setting-up-password-for-default-user/372159/3 "2025-01-15T14:56:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.