# Help updating Elastic ssl keystore - fatal alert:bad certificate error

**URL:** <https://discuss.elastic.co/t/help-updating-elastic-ssl-keystore-fatal-alert-bad-certificate-error/377210>\
**Category:** Elastic Stack\
**Created:** [April 16, 2025, 3:48pm UTC](https://discuss.elastic.co/t/help-updating-elastic-ssl-keystore-fatal-alert-bad-certificate-error/377210 "2025-04-16T15:48:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steven\_Cherry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steven_cherry/32/142673_2.png) [@Steven\_Cherry](https://discuss.elastic.co/u/Steven_Cherry)\
**Post date:** [April 16, 2025, 3:48pm UTC](https://discuss.elastic.co/t/help-updating-elastic-ssl-keystore-fatal-alert-bad-certificate-error/377210/1 "2025-04-16T15:48:30Z")

</div>

I am attempting to update Elastic with a new certificate for the SSL keystore. I created a PFX with an updated certificate and secured it with a password equal to the current password as shown by the command "/usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.http.ssl.keystore.secure\_password".

When I copy the new PFX into place and restart Elastic, I get this warning:

[2025-04-16T09:34:45,188][WARN][o.e.h.AbstractHttpServerTransport] [servername] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/127.0.0.1:9200, remoteAddress=/127.0.0.1:47862}  
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate

And log entries no longer flow to the indices as seen in Kibana. The new certificate uses a different trust chain than the old one, so do I need to add the new root and intermediate certificates to a trust store somewhere? I see a reference to a trust store in elasticsearch.yml, but the existing trust chain is not in it, only the Elastic-generated certificates.

Here is a snippet of my yml:

```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.client_authentication: required
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: caes1-prod.pfx

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 16, 2025, 5:44pm UTC](https://discuss.elastic.co/t/help-updating-elastic-ssl-keystore-fatal-alert-bad-certificate-error/377210/2 "2025-04-16T17:44:11Z")

</div>

Hi @Steven_Cherry Welcome to the community.

Perhaps @TimV can chime, he is one of the resident cert gurus... 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2025, 5:44pm UTC](https://discuss.elastic.co/t/help-updating-elastic-ssl-keystore-fatal-alert-bad-certificate-error/377210/3 "2025-05-14T17:44:14Z")

</div>

Closed on May 14, 2025, 5:44pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.