# javax.net.ssl.SSLHandshakeException: Empty client certificate chain **URL:** \ **Category:** Elasticsearch\ **Created:** [August 17, 2023, 2:10pm UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-empty-client-certificate-chain/341024 "2023-08-17T14:10:54Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![nick\_harper1](https://avatars.discourse-cdn.com/v4/letter/n/c37758/32.png) [@nick\_harper1](https://discuss.elastic.co/u/nick_harper1)\ **Post date:** [August 17, 2023, 2:10pm UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-empty-client-certificate-chain/341024/1 "2023-08-17T14:10:54Z")
I have configured a cert that has both server and client enabled but when using this for transport on 9300 I get: exception caught on transport layer [Netty4TcpChannel{localAddress=/10.15.4.16:9300, remoteAddress=/10.15.4.18:37056, profile=default}], closing connection io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty client certificate chain When I run this: openssl s\_client -connect 10.15.4.18:9300 \/dev/null | openssl x509 -inform pem -text I can see the following: X509v3 extensions: 1.3.6.1.4.1.311.21.7: 0-.%+.....7.............\*...x.......~......d... X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication X509v3 Key Usage: Digital Signature, Key Encipherment 1.3.6.1.4.1.311.21.10: 0.0 So it is set for client. What else is missing? Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2023, 2:10pm UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-empty-client-certificate-chain/341024/2 "2023-09-14T14:10:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.