# I'm trying to move my elastic stack to 7.16.2 (from 6.8.22) in docker-compose - but fails to get certificates generated **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, docker\ **Created:** [December 22, 2021, 11:58am UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675 "2021-12-22T11:58:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\ **Post date:** [December 22, 2021, 11:58am UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675/1 "2021-12-22T11:58:55Z")
With the Log4J vulnerability I've been tasked to update our quite dated Elasticsearch stack. We were on 6.5.1, which I moved to 6.8.22 without issues. Now I want to move it to 7.16.2. There isn't that much with rolling updates, as this system is used for logging analysis, and its primarily used retrospective, so I've just shut everything down to get this working. I looked at this guide: [Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide [7.16] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls-docker.html) And I can see I need to enable passwords and certificates. So I modified the docker-compose file, and now I'm trying to get the certificates generated, but so far without luck. When I run the `docker-compose -f create-certs.yml run --rm create_certs` I get an error: `unzip: cannot find or open /certs/bundle.zip, /certs/bundle.zip.zip or /certs/bundle.zip.ZIP.` So as I see it, it doesn't create the certs. How do I solve that? ---
**Author:** ![carldavis](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@carldavis](https://discuss.elastic.co/u/carldavis)\ **Post date:** [December 22, 2021, 6:02pm UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675/3 "2021-12-22T18:02:05Z")
I believe the problem lies with the certutil, but I cannot determine a way to resolve the issue. ```auto [root@046483922bd9 elasticsearch]# bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out /certs/bundle.zip Exception in thread "main" java.nio.file.NoSuchFileException: /usr/share/elasticsearch/config/certificates/instances.yml at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:92) at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106) at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:219) at java.base/java.nio.file.Files.newByteChannel(Files.java:375) at java.base/java.nio.file.Files.newByteChannel(Files.java:426) at java.base/java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:420) at java.base/java.nio.file.Files.newInputStream(Files.java:160) at java.base/java.nio.file.Files.newBufferedReader(Files.java:2916) at java.base/java.nio.file.Files.newBufferedReader(Files.java:2948) at org.elasticsearch.xpack.security.cli.CertificateTool.parseFile(CertificateTool.java:940) at org.elasticsearch.xpack.security.cli.CertificateTool.parseAndValidateFile(CertificateTool.java:913) at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.getCertificateInformationList(CertificateTool.java:405) at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.execute(CertificateTool.java:695) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116) at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:80) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116) at org.elasticsearch.cli.Command.main(Command.java:79) at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:138) ``` ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 23, 2021, 12:18am UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675/4 "2021-12-23T00:18:46Z")
```auto NoSuchFileException: /usr/share/elasticsearch/config/certificates/instances.yml ``` certutil has some _quirks_ with the way it resolves the current directory. You might need to pass an absolute path to the command line so that it find the correct file. ---
**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\ **Post date:** [December 23, 2021, 7:34am UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675/5 "2021-12-23T07:34:32Z")
Hi Tim Ahaa, interesting, but I don't see a file called `instances.yml` under `/usr/share/elasticsearch/config/certificates` so where is it supposed to be? I also tried searching for it, without luck so far. (I'm pulling the 7.16.2 image for docker in this case). ---
**Author:** ![carldavis](https://avatars.discourse-cdn.com/v4/letter/c/67e7ee/32.png) [@carldavis](https://discuss.elastic.co/u/carldavis)\ **Post date:** [December 23, 2021, 1:27pm UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675/6 "2021-12-23T13:27:49Z")
I created the file and populated with this and it seemed to work. I'm having other non-related issues now so I think the cert creation succeeded. ```auto instances: - name: es01 dns: - es01 - localhost ip: - 127.0.0.1 - name: es02 dns: - es02 - localhost ip: - 127.0.0.1 ``` ---
**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\ **Post date:** [January 4, 2022, 1:06pm UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675/7 "2022-01-04T13:06:49Z")
Ok, I got everything configured, and I think I lost all my data 😢 I didn't realize the -v also removed volumes until it was too late. So now I'm trying to get it up and running to see if the snapshots I have at least contains some data I can restore, especially all the work in kibana would be devastating to loose. Now, I can connect to each node, and I can see that it has certificates configured, and I also get the 'tagline' shown, so for me it looks like the Elasticsearch in itself is running. I would like to get my elastichq up and running again, but it doesn't connect to the cluster, not sure how that is. I can ping the URL's from inside the elastichq container, but I just get 'cannot connect'. I have my backup folder in the hostfile system, and it contains 28GB data, which is not a lot, but it might contain something, but if I go and send a GET \_snapshot I just get a {} response. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 1, 2022, 1:07pm UTC](https://discuss.elastic.co/t/im-trying-to-move-my-elastic-stack-to-7-16-2-from-6-8-22-in-docker-compose-but-fails-to-get-certificates-generated/292675/8 "2022-02-01T13:07:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.