# Invalid SSL cert error when connecting to elasticsearch using DBeaver **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, docker\ **Created:** [July 13, 2021, 9:21am UTC](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510 "2021-07-13T09:21:18Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Fong\_Ng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fong_ng/32/21533_2.png) [@Fong\_Ng](https://discuss.elastic.co/u/Fong_Ng)\ **Post date:** [July 13, 2021, 9:21am UTC](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510/1 "2021-07-13T09:21:18Z")
I have trouble using SSL keystore or truststore to connect to Elasticsearch client using DBeaver. This is an elastic stack on k8s installation on my local machine. I followed the [official tutorial](https://www.elastic.co/guide/en/elasticsearch/reference/current/sql-client-apps-dbeaver.html) to set up a connection using DBeaver, but I have trouble figuring out how to make SSL validation work. I logged into the elasticsearch pod, downloaded the cert and key at `/usr/share/elasticsearch/config/http-certs/tls.crt` and `/usr/share/elasticsearch/config/http-certs/tls.key`. I combined them into a p12 format using this command: `openssl pkcs12 -export -in combined.pem -out cert.p12` elasticsearch.config: ``` http: ssl: certificate: /usr/share/elasticsearch/config/http-certs/tls.crt certificate_authorities: /usr/share/elasticsearch/config/http-certs/ca.crt enabled: true key: /usr/share/elasticsearch/config/http-certs/tls.key transport: ssl: certificate: /usr/share/elasticsearch/config/node-transport-cert/transport.tls.crt certificate_authorities: - /usr/share/elasticsearch/config/transport-certs/ca.crt - /usr/share/elasticsearch/config/transport-remote-certs/ca.crt enabled: "true" key: /usr/share/elasticsearch/config/node-transport-cert/transport.tls.key verification_mode: certificate ``` However, I'm getting this invalid cert error: ![Screenshot_2021-07-13_16-55-22](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b3aa1825d116ac64bf040eadb8e9d3b3207ca51.png) These are the driver parameters: ![Screenshot_2021-07-13_16-56-20](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2bb05b16e9ed2b86c2060a0f21c08dd01e0daeba.png) What certs do I need in order to pass the cert check? I wish there was an insecure flag to ignore the validation since it runs in localhost. ---
**Author:** ![kpe](https://avatars.discourse-cdn.com/v4/letter/k/b5e925/32.png) [@kpe](https://discuss.elastic.co/u/kpe)\ **Post date:** [July 13, 2021, 3:35pm UTC](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510/2 "2021-07-13T15:35:54Z")
Hello Fong\_Ng, Try to import the SSL certificate in the Java keystore. %JAVA\_HOME%/bin/keytool -import -keystore %JAVA\_HOME%/lib/security/cacerts -file certifcate.crt -alias elk > Regards, Kevin ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 14, 2021, 12:48am UTC](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510/3 "2021-07-14T00:48:15Z")
You have added the Elasticsearch certificate and key as a keystore in DBeaver. However, what you should be doing here is adding the certificate (or even better the CA) to DBeaver's truststore. As @kpe has suggested, you should use `keytool` for this, but you might not want to add it to the JVM's cacerts. You can do: ```auto keytool -import -keystore elasticsearch.p12 -file /usr/share/elasticsearch/config/http-certs/ca.crt ``` And then in the DBeaver driver parameters, set `ssl.truststore.location` to point to your new `elasticsearch.p12` ---
**Author:** ![Fong\_Ng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fong_ng/32/21533_2.png) [@Fong\_Ng](https://discuss.elastic.co/u/Fong_Ng)\ **Post date:** [July 14, 2021, 1:46pm UTC](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510/4 "2021-07-14T13:46:43Z")
Thank you for the answers. This problem is solved. These are the steps to solve the invalid cert error: - Get the content of `ca.cert` of a k8s secret named `ES_NAME-es-http-certs-public`. - Save the CA cert content to a file (e.g /home/my/ca.crt) on my desktop - Run `keytool -import -keystore elasticsearch.p12 -file /home/my/ca.crt` and set a password for the truststore file. - Enter the related Dbeaver driver parameters: `ssl.truststore.location` - /home/my/ca.crt `ssl.truststore.password` - YOUR\_PASSWORD `ssl.truststore.type` - PKCS12 - Add this line to `/etc/hosts` on my desktop: ```auto 127.0.0.1 ES_NAME-es-http.default.svc ``` I port forward connection from the k8s cluster to my desktop. At first when the DBeaver connected to the elasticsearch via `jdbc:es://https://127.0.0.1:9200/` I got this error: ```auto No subject alternative DNS name matching ``` I have to use `jdbc:es://https://ES_NAME-es-http.default.svc:9200/` instead, and that requires adding that line to `/etc/hosts`. The `ES_NAME-es-http` is the service name of the es cluster, and `default` is the namespace where the service is located. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 11, 2021, 1:47pm UTC](https://discuss.elastic.co/t/invalid-ssl-cert-error-when-connecting-to-elasticsearch-using-dbeaver/278510/5 "2021-08-11T13:47:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.