# How import self-signed ca for es8.4.2

**URL:** <https://discuss.elastic.co/t/how-import-self-signed-ca-for-es8-4-2/356990>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 8, 2024, 3:32pm UTC](https://discuss.elastic.co/t/how-import-self-signed-ca-for-es8-4-2/356990 "2024-04-08T15:32:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![YZ\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yz_xie/32/133361_2.png) [@YZ\_Xie](https://discuss.elastic.co/u/YZ_Xie)\
**Post date:** [April 8, 2024, 3:32pm UTC](https://discuss.elastic.co/t/how-import-self-signed-ca-for-es8-4-2/356990/1 "2024-04-08T15:32:54Z")

</div>

We signed a cert from our internal ca, then xpack.security.transport.ssl configured use this cert, I know need import ca cert to es to solve this problem, but how to import it?  
I tried below command, but failed

```auto
keytool -importcert -trustcacerts -file ${SHARE_DIR}/ubuntu/cert/certs/xiamu.com.cert -alias xiamu.com -keystore "/usr/local/elasticsearch-8.4.2/jdk/lib/security/cacerts" -storepass changeit

```

below is error log

```auto
e_cluster_client, data, data_cold, ingest, data_frozen]
[2024-04-08T23:27:21,955][ERROR][o.e.b.Elasticsearch] [es-node1] fatal exception while booting Elasticsearchorg.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl] - the truststore [/usr/local/elasticsearch-8.4.2/config/certs/xiamu.com.p12] does not contain any trusted certificate entries
        at org.elasticsearch.xcore@8.4.2/org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSslConfigurations$11(SSLService.java:605)
        at java.base/java.util.HashMap.forEach(HashMap.java:1421)
        at java.base/java.util.Collections$UnmodifiableMap.forEach(Collections.java:1553)
        at org.elasticsearch.xcore@8.4.2/org.elasticsearch.xpack.core.ssl.SSLService.loadSslConfigurations(SSLService.java:601)
        at org.elasticsearch.xcore@8.4.2/org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:156)

See logs for more details.

```

---

<div class="post-metadata">

**Author:** ![YZ\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yz_xie/32/133361_2.png) [@YZ\_Xie](https://discuss.elastic.co/u/YZ_Xie)\
**Post date:** [April 8, 2024, 4:40pm UTC](https://discuss.elastic.co/t/how-import-self-signed-ca-for-es8-4-2/356990/2 "2024-04-08T16:40:40Z")

</div>

I use below command transfer server cert to p12 format

```auto
openssl pkcs12 -export -in ${SHARE_DIR}/ubuntu/cert/certs/xiamu.com.cert -inkey ${SHARE_DIR}/ubuntu/cert/xiamu.com/private/xiamu.com.key -out ${SHARE_DIR}/ubuntu/cert/certs/xiamu.com.p12

```

---

<div class="post-metadata">

**Author:** ![YZ\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yz_xie/32/133361_2.png) [@YZ\_Xie](https://discuss.elastic.co/u/YZ_Xie)\
**Post date:** [April 9, 2024, 3:54pm UTC](https://discuss.elastic.co/t/how-import-self-signed-ca-for-es8-4-2/356990/3 "2024-04-09T15:54:07Z")

</div>

fixed by blog.xiedeacc.com/archives/1712677655309

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2024, 3:54pm UTC](https://discuss.elastic.co/t/how-import-self-signed-ca-for-es8-4-2/356990/4 "2024-05-07T15:54:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.