# Help! ES do not trust the certificate

**URL:** <https://discuss.elastic.co/t/help-es-do-not-trust-the-certificate/186446>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 19, 2019, 11:17am UTC](https://discuss.elastic.co/t/help-es-do-not-trust-the-certificate/186446 "2019-06-19T11:17:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Post date:** [June 19, 2019, 11:17am UTC](https://discuss.elastic.co/t/help-es-do-not-trust-the-certificate/186446/1 "2019-06-19T11:17:08Z")

</div>

Hi everyone,

I try to connect Eleasticsearch 6.8.0 via TransportClient(enable TLS), I created ca with command "./bin/elasticsearch-certutil ca --pem", then I unzip the zip file, move the ca profile to elasticsearch/config/ directory.

Then I created instance.crt and instance.key with command "./bin/elasticsearch-certutil cert --ca-cert config/ca/ca.crt --ca-key config/ca/ca.key --pem", I unzip the instance.zip and move the instance profile to elasticsearch/config/ directory.

This is configuration used in my elasticsearch.yml:

xpack.security.enabled: true  
xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.verification\_mode: certificate  
xpack.security.transport.ssl.key: instance/instance.key  
xpack.security.transport.ssl.certificate: instance/instance.crt  
xpack.security.transport.ssl.certificate\_authorities: ["ca/ca.crt"]

Then I copy ca.crt、instance.key and instance.crt to the other computer where I want to connect ES cluster with JAVA API.

This is the code:  
Settings.Builder builder = Settings.builder();  
builder.put("cluster.name", es\_server\_clustername);  
builder.put("xpack.security.user", "username:password");  
builder.put("xpack.ssl.key", "/mypath/instance.key");  
builder.put("xpack.ssl.certificate", "/mypath/instance.crt");  
builder.put("xpack.ssl.certificate\_authorities", "/mypath/ca.crt");  
builder.put("xpack.security.transport.ssl.enabled", "true");  
Settings settings = builder.build();  
client = new PreBuiltXPackTransportClient(settings);

while connecting transport client I am getting below error on elasticsearch:  
[2019-06-19T18:50:56,309][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [jo-2] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/172.x.x.xxx:63194}

I think I config according to the ES document, can you tell me what the problem is?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 20, 2019, 3:07am UTC](https://discuss.elastic.co/t/help-es-do-not-trust-the-certificate/186446/2 "2019-06-20T03:07:57Z")

</div>

I strongly discourage using the same certificate+key for both the server and client. I would recommend that you create a new "client" cert using the same CA cert.

```auto
./bin/elasticsearch-certutil cert --ca-cert config/ca/ca.crt --ca-key config/ca/ca.key \
   --pem --name client --out client.zip

```

> [@yeziblo](#):
>
> I am getting below error on elasticsearch:
> 
> ```
> [2019-06-19T18:50:56,309][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [jo-2]
> client did not trust this server's certificate, closing connection
> Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/172.x.x.xxx:63194}
> 
> ```

It would be helpful if you configure your client to log its own errors. Diagnosing the problems from the wrong side of the connection is hard.

The problems appears to be that your `instance.crt` doesn't include any IP/Hostname information, but your client is configured to require it.

The recommended code would be

```auto
Settings.Builder builder = Settings.builder();
builder.put("cluster.name", es_server_clustername);
builder.put("xpack.security.user", "username:password");
builder.put("xpack.security.transport.ssl.enabled", "true");
builder.put("xpack.security.transport.ssl.verification_mode", "certificate");
builder.put("xpack.security.transport.ssl.key", "/mypath/instance.key");
builder.put("xpack.security.transport.ssl.certificate", "/mypath/instance.crt");
builder.putList("xpack.security.transport.ssl.certificate_authorities", "/mypath/ca.crt");
Settings settings = builder.build();
client = new PreBuiltXPackTransportClient(settings);

```

---

<div class="post-metadata">

**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Post date:** [June 20, 2019, 3:15am UTC](https://discuss.elastic.co/t/help-es-do-not-trust-the-certificate/186446/3 "2019-06-20T03:15:40Z")

</div>

Hi @TimV  
Thank you so much. It really worked！  
I will use a new client cert as you said.  
thanks and best regards!  
yeziblo

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2019, 3:15am UTC](https://discuss.elastic.co/t/help-es-do-not-trust-the-certificate/186446/4 "2019-07-18T03:15:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.