# How configure .p12 certificate in Elasticsearch TLS/SSL?

**URL:** <https://discuss.elastic.co/t/how-configure-p12-certificate-in-elasticsearch-tls-ssl/158204>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 26, 2018, 3:16pm UTC](https://discuss.elastic.co/t/how-configure-p12-certificate-in-elasticsearch-tls-ssl/158204 "2018-11-26T15:16:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [November 26, 2018, 3:16pm UTC](https://discuss.elastic.co/t/how-configure-p12-certificate-in-elasticsearch-tls-ssl/158204/1 "2018-11-26T15:16:22Z")

</div>

Hi All ,

I have a 6.4 version 5 node cluster . Each nod had a ".p12" certificate and a password 12345.

Followed Doc:  
[https://www.elastic.co/guide/en/elasticsearch/reference/6.4/configuring-tls.html#tls-transport](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/configuring-tls.html#tls-transport)

My conf is like:

xpack.security.transport.ssl.enabled: true  
xpack.security.transport.ssl.verification\_mode: certificate  
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certs/nodename.p12  
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certs/nodename.p12  
xpack.security.http.ssl.enabled: true

Passwords added by command:

From: /usr/share/elasticseach  
./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure\_password

./bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure\_password

Used same passoword: 12345 ( for keystore and trust store)

Error Log:  
Master 1:  
[2018-11-26T15:15:45,269][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbricemtrs02.corp.internal] client did not trust this server's certificate, closing connection NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/Master2 IP:45718}

Master 2:  
[2018-11-26T15:15:45,269][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbricemtrs02.corp.internal] client did not trust this server's certificate, closing connection NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/Master1 IP:45718}

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [November 26, 2018, 3:17pm UTC](https://discuss.elastic.co/t/how-configure-p12-certificate-in-elasticsearch-tls-ssl/158204/2 "2018-11-26T15:17:07Z")

</div>

Master 1 Log:

[2018-11-26T15:07:48,338][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbricemtrs01.corp.internal] exception caught on transport layer [NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:44648, remoteAddress=gbricemtrs02/10.142.1.110:9300}], closing connection  
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: General SSLEngine problem  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1359) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:935) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:545) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-transport-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.16.Final.jar:4.1.16.Final]  
at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_181]  
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem  
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1529) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) ~[?:?]  
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[?:1.8.0\_181]  
at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:281) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1215) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
... 15 more

---

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [November 26, 2018, 3:17pm UTC](https://discuss.elastic.co/t/how-configure-p12-certificate-in-elasticsearch-tls-ssl/158204/3 "2018-11-26T15:17:15Z")

</div>

Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem  
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728) ~[?:?]  
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:330) ~[?:?]  
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322) ~[?:?]  
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614) ~[?:?]  
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?]  
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:992) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:989) ~[?:?]  
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_181]  
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467) ~[?:?]  
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1364) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1272) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
... 15 more  
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397) ~[?:?]  
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) ~[?:?]  
at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?]  
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1601) ~[?:?]  
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?]  
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:992) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:989) ~[?:?]  
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_181]  
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467) ~[?:?]  
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1364) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1272) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
... 15 more  
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) ~[?:?]  
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) ~[?:?]  
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ~[?:1.8.0\_181]  
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392) ~[?:?]  
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) ~[?:?]  
at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?]  
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1601) ~[?:?]  
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?]  
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:992) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:989) ~[?:?]  
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_181]  
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467) ~[?:?]  
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1364) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1272) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 26, 2018, 10:59pm UTC](https://discuss.elastic.co/t/how-configure-p12-certificate-in-elasticsearch-tls-ssl/158204/4 "2018-11-26T22:59:03Z")

</div>

It's easier for us to help you if you keep things in the one topic. Let's continue the discussion here - [TLS/SSL enabled cluster , SSL is working TSL not working with p12 cert password protected](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/6)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 26, 2018, 10:59pm UTC](https://discuss.elastic.co/t/how-configure-p12-certificate-in-elasticsearch-tls-ssl/158204/5 "2018-11-26T22:59:06Z")

</div>