# javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [February 24, 2021, 4:03pm UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/265369 "2021-02-24T16:03:16Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![d.balaaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.balaaji/32/84486_2.png) [@d.balaaji](https://discuss.elastic.co/u/d.balaaji)\ **Post date:** [February 24, 2021, 4:03pm UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/265369/1 "2021-02-24T16:03:16Z")
Hello All, I configured 4 node Elasticsearch cluster. 1 -M, 2-M/D and 1 - D nodes. I have encrypted TLS using p12 and generated pem to get the organisation signed certificates. Certificate was generated as below. ./keytool -genkeypair -alias elastic-dev1 -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -keypass \<\> -storepass \<\> -validity 3650 -keystore elastic-dev1.jks -dname "[CN=dev1.search.ocv.example.com](http://CN=dev1.search.ocv.example.com), OU=Data, O=example Banking Group, L=Melbourne, ST=VIC, C=AU" -ext SAN=DNS:dev1.search.ocv.example.com,DNS:delaa01l.unix.example,DNS:delaa02l.unix.example Generate .pem certificate ./keytool -certreq -alias elastic-dev1 -file certreq.pem -keystore elastic-dev1.jks -ext SAN=DNS:dev1.search.ocv.example.com,DNS:delaa01l.unix.example,DNS:delaa02l.unix.example Create a directory 'certs' at the location '/app/elasticsearch/config' and copy the elastic-dev1.jks file into certs directory Raise a request for CA signer certificates. Click on the below url and follow the steps mentioned in the section "Request for CA Signer certificate" Once we receive the certificate then download all the internal certs ([dev1.search.ocv.example.com](http://dev1.search.ocv.example.com), example\_GlobalTest\_Root\_CA\_v2.cer and example\_GlobalTest\_CA\_02\_v2.cer) to the location ''/app/elastic/config/certs' of elastic server. executed the below commands ./keytool -importcert -file example\_GlobalTest\_Root\_CA\_v2.cer -keystore elastic-dev1.jks -alias "example\_GlobalTest\_Root\_CA\_v2" ./keytool -importcert -file example\_GlobalTest\_CA\_02\_v2.cer -keystore elastic-dev1.jks -alias "example\_GlobalTest\_CA\_02\_v2" ./keytool -importcert -file dev1.search.ocv.example.com.cer -keystore elastic-dev1.jks -alias "[dev1.search.ocv.example.com](http://dev1.search.ocv.example.com)" ./keytool -importkeystore -srckeystore elastic-dev1.jks -destkeystore elastic-dev1.p12 -srcstoretype JKS -deststoretype PKCS12 -deststorepass [PASSWORD\_PKCS12] openssl pkcs12 -in elastic-dev1.p12 -out client-ca.pem -clcerts -nokeys Copy all certs to /etc/elasticsearch/certs and created soft-link to config location. Done in all nodes. Cluster is able to start, however getting below error.. [2021-02-25T00:18:12,396][WARN][o.e.t.TcpTransport] [delaa11l.unixtest.anz] exception caught on transport layer [Netty4TcpChannel{localAddress=/10.204.194.22:9384, remoteAddress=/10.204.194.22:41768}], closing connection io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~[netty-codec-4.1.49.Final.jar:4.1.49.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-codec-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:615) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:578) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-transport-4.1.49.Final.jar:4.1.49.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) [netty-common-4.1.49.Final.jar:4.1.49.Final] at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.49.Final.jar:4.1.49.Final] at java.lang.Thread.run(Thread.java:832) [?:?] Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate [elastic@delaa11l /app/elastic/fmp-e2e2/elasticsearch/config] $ curl -XGET '[https://delaa11l.unixtest.anz:9284/\_cluster/health?pretty](https://delaa11l.unixtest.anz:9284/_cluster/health?pretty)' -H'Content-Type: application/json' curl: (60) Issuer certificate is invalid. More details here: [http://curl.haxx.se/docs/sslcerts.html](http://curl.haxx.se/docs/sslcerts.html) curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 25, 2021, 7:35am UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/265369/2 "2021-02-25T07:35:02Z")
You need to also show us your elasticsearch.yml and specifically the parts where you configure TLS. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 25, 2021, 7:35am UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/265369/3 "2021-03-25T07:35:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.