# Kibana not trusting my elasticsearch/shield CA
**URL:** https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [March 15, 2016, 4:36pm UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461 "2016-03-15T16:36:13Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@bblank](https://discuss.elastic.co/u/bblank)
#### Post date: [March 15, 2016, 4:36pm UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461/1 "2016-03-15T16:36:14Z")
I have Elasticsearch up an running with Shield and SSL using local authentication. The browser on my workstation trusts the site when I go to [https://myserver.mydomain.com:9200](https://myserver.mydomain.com:9200)
I have updated the Kibana.yml file:
elasticsearch.url: "[https://myserver.mydomain.com:9200/](https://myserver.mydomain.com:9200/)"
[elasticsearch.ssl.ca](http://elasticsearch.ssl.ca): /opt/elasticsearch/config/shield/Chain.pem (This is the certificate chain for my internal CA)
Kibana won't connect to Elasticsearch unless I add the:
elasticsearch.ssl.verify: false
What am I missing? What CA store is Kibana trying to use?
Thanks for any advice.
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [March 18, 2016, 9:59am UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461/2 "2016-03-18T09:59:11Z")
Hi Bob,
You mentioned a cert chain, which implies you have more than a single cert in that file. I believe you need to specify each certificate separately due to the way node.js works. Something like:
```
elasticsearch.ssl.ca: ["/path/to/root.pem", "/path/to/intermediate.pem"]
```
-Jay
---
### Author:  [@bblank](https://discuss.elastic.co/u/bblank)
#### Post date: [March 18, 2016, 2:00pm UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461/3 "2016-03-18T14:00:55Z")
Yes. We do have a cert chain and your suggestion worked! Thanks!
Bob.
---
### Author:  [@dfr0](https://discuss.elastic.co/u/dfr0)
#### Post date: [March 22, 2016, 3:57am UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461/4 "2016-03-22T03:57:55Z")
I'm for example used my logstash-forwarder certificate 😁
---
### Author:  [@bblank](https://discuss.elastic.co/u/bblank)
#### Post date: [March 22, 2016, 12:59pm UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461/5 "2016-03-22T12:59:55Z")
For logstash to elasticsearch over SSL, keep your CA certificate chain in ONE PEM file. Here is a sample from my logstash.conf file:
output {
```
elasticsearch {
hosts => ["https://elastic.mydomain.com:9200"]
user => myuser
password => mypassword
ssl => true
cacert => "/opt/logstash/etc/certs/MY_CA_Chain.pem"
}
```
}
---
### Author:  [@bblank](https://discuss.elastic.co/u/bblank)
#### Post date: [April 28, 2016, 6:18pm UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461/6 "2016-04-28T18:18:15Z")
It looks like Kibana 4.5.0 can now read a .pem file with multiple certs in the chain. No need to split the certs into an array.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/kibana-not-trusting-my-elasticsearch-shield-ca/44461/7 "2017-07-06T13:44:58Z")