# Issue with pki elastic search hadoop **URL:** \ **Category:** Elasticsearch\ **Tags:** es-hadoop\ **Created:** [December 30, 2015, 11:16pm UTC](https://discuss.elastic.co/t/issue-with-pki-elastic-search-hadoop/38202 "2015-12-30T23:16:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![srikrishna.alla](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@srikrishna.alla](https://discuss.elastic.co/u/srikrishna.alla)\ **Post date:** [December 30, 2015, 11:16pm UTC](https://discuss.elastic.co/t/issue-with-pki-elastic-search-hadoop/38202/1 "2015-12-30T23:16:17Z")
Hi, I am having an issue accessing hive table when pki is turned on. These are the steps I have followed for setting up pki- 1. Created a CA a. Generate a self-signed CA certificate to establish your CA as an authority. ( **_Make sure to remember the PEM passphrase_** ) openssl req -new -x509 -extensions v3\_ca -keyout private/cakey.pem -out certs/cacert.pem -days 1460 -config conf/caconfig.cnf 2. Copied the cacert.pem to all data nodes. 3. Import our CA cert into a keystore on each elastic search node a. keytool -importcert -keystore /etc/elasticsearch/shield/.jks -file /etc/elasticsearch/shield/cacert.pem -alias 4. Generate a private key for our elastic search nodes and generate a csr for our elastic search nodes. **_NOTE_** Make sure to include the common name for each csr and make it unique(i.e. short host name), this is needed for signing as each csr needs to be unique.) **_END NOTE_** a. keytool -genkey -alias XXXX -keystore es-hadoop.jks -keyalg RSA -keysize 2048 -validity 365 -ext san=dns:xxxx,dns:xxx.xxx.com,ip:10.xx.xx.xx 5. Copy all csrs to the CA system for signing: 6. Sign all of the csr’s. a. openssl ca -in .csr -notext -out -signed.crt -config conf/caconfig.cnf -extensions v3\_req 7. send all of the signed certificates back to the original hosts. 8. Import the signed certs into the keystore. a. keytool -importcert -keystore /opt/mapr/hadoop/es-hadoop.jks -file XXXX.csr-signed.crt -alias XXXX I am using elasticsearch-hadoop-2.2.0-beta1.jar & table properties as - ROW FORMAT SERDE 'org.elasticsearch.hadoop.hive.EsSerDe' STORED BY 'org.elasticsearch.hadoop.hive.EsStorageHandler' WITH SERDEPROPERTIES ( 'serialization.format'='1') TBLPROPERTIES ( 'es.nodes'='[xxxx.xxxx.com:9200](http://xxxx.xxxx.com:9200)', 'es.resource'='xxx/xxxxx', 'es.net.ssl'='true', 'es.net.ssl.keystore.location'='file:///es\_hadoop.jks', 'es.net.ssl.keystore.pass'='' ); Error we are getting is: Failed with exception java.io.IOException:org.elasticsearch.hadoop.rest.EsHadoopInvalidRequest: missing authentication token for REST request [/] ---
**Author:** ![costin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/costin/32/44950_2.png) [@costin](https://discuss.elastic.co/u/costin)\ **Post date:** [December 31, 2015, 3:45pm UTC](https://discuss.elastic.co/t/issue-with-pki-elastic-search-hadoop/38202/2 "2015-12-31T15:45:06Z")
I recommend breaking the process into two steps: 1. configure shield. Use cUrl or other tools to check that http is enabled followed by checking the PKI setup. 2. configure ES-Hadoop. Do note that you should specify your keystore in HDFS or other globally available location on all nodes (file:/// should be used only if _all_ nodes on which the task runs have the file). ---
**Author:** ![srikrishna.alla](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@srikrishna.alla](https://discuss.elastic.co/u/srikrishna.alla)\ **Post date:** [December 31, 2015, 4:39pm UTC](https://discuss.elastic.co/t/issue-with-pki-elastic-search-hadoop/38202/3 "2015-12-31T16:39:47Z")
Thanks, Costin. Will try it out. Thanks, Sri ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:26pm UTC](https://discuss.elastic.co/t/issue-with-pki-elastic-search-hadoop/38202/4 "2017-07-06T13:26:46Z")