# "io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record" after ssl enabling my cluster

**URL:** <https://discuss.elastic.co/t/io-netty-handler-ssl-notsslrecordexception-not-an-ssl-tls-record-after-ssl-enabling-my-cluster/77987>\
**Category:** Elasticsearch\
**Created:** [March 9, 2017, 1:20pm UTC](https://discuss.elastic.co/t/io-netty-handler-ssl-notsslrecordexception-not-an-ssl-tls-record-after-ssl-enabling-my-cluster/77987 "2017-03-09T13:20:39Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Bob\_Metelsky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bob_metelsky/32/11387_2.png) [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\
**Post date:** [March 21, 2017, 6:19pm UTC](https://discuss.elastic.co/t/io-netty-handler-ssl-notsslrecordexception-not-an-ssl-tls-record-after-ssl-enabling-my-cluster/77987/5 "2017-03-21T18:19:06Z")

</div>

> [@Bob\_Metelsky](#):
>
> /usr/share/elasticsearch/bin/config/ca/ca.crt

Im setting this up - per the course

I'm guessing this will protect the 9200-9300 ports of elasticsearch.  
This would be from either this  
[https://nn775:9200/sales\_record/\_search?pretty](https://nn775:9200/sales_record/_search?pretty)

or kibana tryining to connect to elastic

this is my elsticsearch.yml file

...  
CODE  
....  
xpack:  
ssl:  
key: /usr/share/elasticsearch/bin/config/x-pack/nn775/nn775.key  
certificate: /usr/share/elasticsearch/bin/config/x-pack/nn775/nn775.crt  
# This points to where the CA cert is - every node shares this  
certificate\_authorities: /usr/share/elasticsearch/bin/config/ca/ca.crt

```
    # We need to ensure that the transport (port 9300) and HTTP (port
    # 9200) protocols secure communication is enabled:
    xpack:
        security:
            transport.ssl.enabled: true
            http.ssl.enabled: true

    # AUDIT ########################################################
    xpack.security.audit.enabled: true
    xpack.security.audit.outputs: [index, logfile]
    xpack.security.audit.index.settings:
      index:
        number_of_shards: 1
        number_of_replicas: 1

    xpack.security.audit.logfile.events.exclude: [access_granted]
    xpack.security.audit.index.events.exclude: [access_granted]

    ###################################################################
    #xpack.monitoring.enabled: false
    #Set to false to disable X-Pack monitoring. Configure in both elasticsearch.yml and kibana.yml.

    #xpack.graph.enabled: false
    #Set to false to disable X-Pack graph. Configure in both elasticsearch.yml and kibana.yml.

    #xpack.watcher.enabled: false
    #Set to false to disable Watcher. Configure in elasticsearch.yml only.

    #xpack.reporting.enabled: false
    #Set to false to disable X-Pack reporting. Configure in kibana.yml only.

    bootstrap.system_call_filter: false
    cluster.name: EScluster-rack2
    node.name: ${HOSTNAME}
    node.master: true
    node.data: true
    network.host: ${HOSTNAME}
    http.port: 9200
    discovery.zen.minimum_master_nodes: 3
    path.data: /mnt/data/elk/5.2.data
    path.logs: /var/log/elasticsearch
    #
    # Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory
    # available on the system and that the owner of the process is allowed to use this limit.
    #
    discovery.zen.ping.unicast.hosts: ["nn775","sn776","dn777","dn778","dn779"]
    #
    # node.max_local_storage_nodes: 1
    # Require explicit names when deleting indices:
    # action.destructive_requires_name: true

```

...  
CODE  
...

I wasnt getting these errors before I added the certs to the elasticsearc.xml

---

_[View the full topic](https://discuss.elastic.co/t/io-netty-handler-ssl-notsslrecordexception-not-an-ssl-tls-record-after-ssl-enabling-my-cluster/77987)._