# Keystore is tampered with or corrupted, now what?
**URL:** https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847
**Category:** Elasticsearch
**Created:** [November 30, 2017, 10:21pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847 "2017-11-30T22:21:00Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@morphers82](https://discuss.elastic.co/u/morphers82)
#### Post date: [November 30, 2017, 10:21pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/1 "2017-11-30T22:21:00Z")
There is no documentation on how to recreate the elasticsearch-keystore when getting this message when trying to list or add keys to the keystore file:
Exception in thread "main" java.lang.SecurityException: Keystore has been corrupted or tampered with
at org.elasticsearch.common.settings.KeyStoreWrapper.decrypt(KeyStoreWrapper.java:280)
at org.elasticsearch.common.settings.ListKeyStoreCommand.execute(ListKeyStoreCommand.java:50)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:69)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134)
at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:69)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134)
at org.elasticsearch.cli.Command.main(Command.java:90)
at org.elasticsearch.common.settings.KeyStoreCli.main(KeyStoreCli.java:40)
---
### Author:  [@rjernst](https://discuss.elastic.co/u/rjernst)
#### Post date: [November 30, 2017, 10:44pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/2 "2017-11-30T22:44:08Z")
Do you have a series of steps to reproduce this problem? Did you try to tweak the keystore file in any way? This should only happen if the internals of the keystore have been modified without updating the keystore metadata.
---
### Author:  [@morphers82](https://discuss.elastic.co/u/morphers82)
#### Post date: [November 30, 2017, 10:56pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/3 "2017-11-30T22:56:46Z")
It seems like it happened right after i added a key:value where the key is not one that is used at all (ie bad one), but it accepted it and let me enter a value for the bad key:
bin/elasticsearch-keystore add [discovery.ec2.tag.Name](http://discovery.ec2.tag.Name)
this happened on 2 separate machines with same ES 6.0/Kibana 6.0 and x-Pack installed on Ubuntu 16.04 (security turned off, just using it for monitoring) with nothing else on the machines. ES cluster is running still for one, i stopped and tried to restart on second machine but now i can't get the node(s) to start, and no logging is happening after I stopped the node(s)
---
### Author:  [@morphers82](https://discuss.elastic.co/u/morphers82)
#### Post date: [November 30, 2017, 10:58pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/4 "2017-11-30T22:58:29Z")
I tried removing the bad key but it still gave me original error
---
### Author:  [@rjernst](https://discuss.elastic.co/u/rjernst)
#### Post date: [December 1, 2017, 8:29am UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/5 "2017-12-01T08:29:32Z")
What version of elasticsearch?
---
### Author:  [@morphers82](https://discuss.elastic.co/u/morphers82)
#### Post date: [December 1, 2017, 2:40pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/6 "2017-12-01T14:40:31Z")
6.0GA
---
### Author:  [@rjernst](https://discuss.elastic.co/u/rjernst)
#### Post date: [December 2, 2017, 9:43pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/7 "2017-12-02T21:43:26Z")
Thanks for reporting! I've identified the issue and have a fix out for review:
>
Unfortunately there is nothing you can do but recreate your keystore. With that PR, the keystore tool will no longer allow you to accidentally try to add a setting with uppercase letters (which is the underlying issue).
---
### Author:  [@morphers82](https://discuss.elastic.co/u/morphers82)
#### Post date: [December 2, 2017, 11:02pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/8 "2017-12-02T23:02:56Z")
How do you recreate it?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 30, 2017, 11:03pm UTC](https://discuss.elastic.co/t/keystore-is-tampered-with-or-corrupted-now-what/109847/9 "2017-12-30T23:03:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.