Getting SSL issue when running reindex api for elastic cluster build via eck 1.0.1

Elastic Orchestration Elastic Cloud on Kubernetes (ECK)
1

I created elasticsearch cluster with operator (ECK 1.0.1) and configured kibana to talk to elastic cluster. When i'm running reindex api copy the index from our docker elastic cluster to kubernetes cluster I'm getting below error ssl error. I went back to my cluster configuration and modified to so that cluster will use custom http certs instead of default eck certs. I followed this doc for setting up custom certs but cluster is not taking my secret.
https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-tls-certificates.html#k8s-setting-up-your-own-certificate

 "error": {
    "root_cause": [
      {
        "type": "s_s_l_handshake_exception",
        "reason": "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
      }
    ],
    "type": "s_s_l_handshake_exception",
    "reason": "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",
    "caused_by": {
      "type": "validator_exception",
      "reason": "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",
      "caused_by": {
        "type": "sun_cert_path_builder_exception",
        "reason": "unable to find valid certification path to requested target"
      }
    }
  },
  "status": 500
}
2

custom http certs are working, Its typo in one of the CA chain.
But I'm still having that ssl error when running kibana reindex api to copy indices from docker elasticsearch to kubernetes elasticsearch cluster.
Does anyone come across this issue?

3

Did you try to inject the certificate of the remote cluster as a Secret into the one managed by ECK ?

According to the documentation you can then set the path to this certificate using the field reindex.ssl.certificate_authorities in the configuration.