# Kibana failed to load CA: PEM routines:get\_name:no start line **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [May 19, 2022, 7:42pm UTC](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228 "2022-05-19T19:42:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![rileghft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rileghft/32/62263_2.png) [@rileghft](https://discuss.elastic.co/u/rileghft)\ **Post date:** [May 19, 2022, 7:42pm UTC](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228/1 "2022-05-19T19:42:01Z")
I setup an Elasticsearch cluster, and the cluster health is green. Elasticsearch cluster can be reached on kibana server, but kibana failed to start, showing PEM error. Environment: OS: Almalinux 8.6 Kibana version: 8.2 Elasticsearch version: 8.2 I manually generate CA and other certificates, following the steps of official guild. [Update security certificates with a different CA | Elasticsearch Guide [8.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/update-node-certs-different.html) After generating http certificate zip, Elasticsearch-ca.pem under kibana directory in the zip is copied to '/etc/kibana/' and modifying config. ```nohighlight # part of /etc/kibana/kibana.yml elasticsearch.ssl.certificateAuthorities: - /etc/kibana/elasticsearch-ca.pem ``` file: Elasticsearch-ca.pem ```auto -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- ``` After kibana starts, it gets error, and kibana shuts down. ```auto {"ecs":{"version":"8.0.0"},"@timestamp":"2022-05-19T15:29:55.543-04:00","message":"error:0909006C:PEM routines:get_name:no start line","error":{"message":"error:0909006C:PEM routines:get_name:no start line","type":"Error","stack_trace":"Error: error:0909006C:PEM routines:get_name:no start line\n at node:internal/tls/secure-context:65:13\n at Array.forEach ()\n at setCerts (node:internal/tls/secure-context:63:3)\n at configSecureContext (node:internal/tls/secure-context:152:5)\n at Object.createSecureContext (node:_tls_common:117:3)\n at Server.setSecureContext (node:_tls_wrap:1344:27)\n at Server (node:_tls_wrap:1203:8)\n at new Server (node:https:69:3)\n at Object.createServer (node:https:105:10)\n at module.exports.internals.Core._createListener (/usr/share/kibana/node_modules/@hapi/hapi/lib/core.js:543:79)\n at new module.exports.internals.Core (/usr/share/kibana/node_modules/@hapi/hapi/lib/core.js:135:30)\n at Object.module.exports (/usr/share/kibana/node_modules/@hapi/hapi/lib/server.js:23:18)\n at new (/usr/share/kibana/node_modules/elastic-apm-node/lib/instrumentation/modules/hapi.js:25:24)\n at createServer (/usr/share/kibana/node_modules/@kbn/server-http-tools/target_node/create_server.js:18:18)\n at HttpServer.setup (/usr/share/kibana/src/core/server/http/http_server.js:102:53)\n at HttpService.preboot (/usr/share/kibana/src/core/server/http/http_service.js:74:51)\n at Server.preboot (/usr/share/kibana/src/core/server/server.js:175:25)\n at Root.preboot (/usr/share/kibana/src/core/server/root/index.js:48:14)\n at bootstrap (/usr/share/kibana/src/core/server/bootstrap.js:99:9)\n at Command. (/usr/share/kibana/src/cli/serve/serve.js:216:5)"},"log":{"level":"FATAL","logger":"root"},"process":{"pid":22684},"trace":{"id":"7eb185da53d5ab38acc4a46cc7ebcccb"},"transaction":{"id":"b14d366f11754cec"}} ``` How to solve the problem? Besides, Elasticsearch-create-enroldlment-token also failed, and it gets error "ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate". Moreover, elastic user password was resetted every time when I restart Elasticsearch cluster. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [May 20, 2022, 4:34am UTC](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228/2 "2022-05-20T04:34:55Z")
> [@rileghft](#): > > Elasticsearch-create-enroldlment-token also failed, and it gets error "ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate". How did you configure your node? Did you manually configure security or rely on security auto configuration? > [@rileghft](#): > > Moreover, elastic user password was resetted every time when I restart Elasticsearch cluster. It sounds like your cluster has transient storage. Are you running in docker? If so you need to make sure that the `config` and `data` directories are mounted from somewhere that will persist between container restarts. ---
**Author:** ![rileghft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rileghft/32/62263_2.png) [@rileghft](https://discuss.elastic.co/u/rileghft)\ **Post date:** [May 20, 2022, 7:11pm UTC](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228/3 "2022-05-20T19:11:54Z")
> [@TimV](#): > > docker Thank you for your reply. 1. I installed elasticsearch from repo, and I missed elastic user password and access tokens when it started. As the result, I manually configured security settings. The following steps are what I did: a. Install elasticsearch from elasticsearch 8.2 repo on each machine. 2. I ran elasticsearch on EXSI VM. There are 3 master nodes and 2 data nodes, and they installed on different machine in network subnet 10.0.1.0/24. Master nodes uses local storage, and data nodes uses external mounted 2TB xfs storage as elasticsearch data storage. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 17, 2022, 7:12pm UTC](https://discuss.elastic.co/t/kibana-failed-to-load-ca-pem-routinesno-start-line/305228/4 "2022-06-17T19:12:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.