# Kibana watcher error throwing SSL handshake even though CA is same for both Kibana & Elasticsearch **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [June 16, 2023, 6:58pm UTC](https://discuss.elastic.co/t/kibana-watcher-error-throwing-ssl-handshake-even-though-ca-is-same-for-both-kibana-elasticsearch/336256 "2023-06-16T18:58:12Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![vee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vee/32/55759_2.png) [@vee](https://discuss.elastic.co/u/vee)\ **Post date:** [June 16, 2023, 6:58pm UTC](https://discuss.elastic.co/t/kibana-watcher-error-throwing-ssl-handshake-even-though-ca-is-same-for-both-kibana-elasticsearch/336256/1 "2023-06-16T18:58:12Z")
Kibana watcher error throwing SSL handshake even though CA is same for both Kibana & Elasticsearch. Here's the error: Attaching the watcher definition as well. ```auto "error" : { "root_cause" : [ { "type" : "s_s_l_handshake_exception", "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" } ], "type" : "s_s_l_handshake_exception", "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", "caused_by" : { "type" : "validator_exception", "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", "caused_by" : { "type" : "sun_cert_path_builder_exception", "reason" : "unable to find valid certification path to requested target" } } } ``` The same watcher was working until last week, when we streamlined all the certificates to use for http & transport - to simplify the settings, used the certificate for transport same as http. Elasticsearch.yml settings: ```auto #Transport layer encryption (new changes) xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.certificate: /etc/elasticsearch/config/certs/company_signed.cer xpack.security.transport.ssl.key: /etc/elasticsearch/config/certs/company_signedcer_key.pem xpack.security.transport.ssl.certificate_authorities: /etc/elasticsearch/config/certs/company_Root.crt # HTTP client encryption (same as existing) xpack.security.http.ssl.enabled: true xpack.http.ssl.verification_mode: certificate xpack.security.http.ssl.certificate: /etc/elasticsearch/config/certs/company_signed.cer xpack.security.http.ssl.key: /etc/elasticsearch/config/certs/company_signedcer_key.pem xpack.security.http.ssl.certificate_authorities: /etc/elasticsearch/config/certs/company_Root.crt ``` Kibana.yml: ```auto elasticsearch.hosts: ["https://xyz:9200"] elasticsearch.ssl.certificateAuthorities: /etc/elasticsearch/config/certs/company_Root.crt elasticsearch.ssl.verificationMode: certificate ... ... server.ssl.enabled: true server.ssl.certificate: /etc/elasticsearch/config/certs/company_signed.cer #same cert as used in elasticsearch.yml server.ssl.key: /etc/elasticsearch/config/certs/company_signedcer_key.pem server.ssl.certificateAuthorities: /etc/elasticsearch/config/certs/company_Root.crt server.publicBaseUrl: https://logs-uat.com ``` Tried to search around before posting here, and came across these two links - > [@Watcher for Reporting shows an SSL Exception in the output](https://discuss.elastic.co/t/watcher-for-reporting-shows-an-ssl-exception-in-the-output/138048/17): > > I've removed the report section, and the email sends without a problem. So there is something about this portion: "attachments": { "error.pdf": { "reporting": { "url": "https://vccn7:5601/api/reporting/jobs/download/jj0j4zsp0zw290eb70b9g26e", "retries": 5, "interval": "15s" } } }, There are a few certs in play here. The first is for node to node elasticsearch communication, and it is all self-signed. Next is our private CA signed cert for https connections via nginx or kibana. The last is for… > [@Watcher for report with attachment failed due to ssl handshake exception](https://discuss.elastic.co/t/watcher-for-report-with-attachment-failed-due-to-ssl-handshake-exception/238924): > > Unable to send reporting attachment by the help of watcher. My watch query : PUT \_watcher/watch/sample\_report\_ssl { "trigger" : { "schedule": { "interval": "1m" } }, "actions" : { "email\_admin" : { "email": { "from": "\*\*\*\*\*\*\*@gmail.com", "to": "\*\*\*\*\*\*\*\*\*@gmail.com", "subject": "Error Report", "attachments" : { "error\_report.pdf" : { "reporting" : { "url": "Copied Post URL from Share tab", … But both appears to be the case with different CA and so had to be added to elastic. In my case, however, the CA is same for the cert being used on Kibana & Elasticsearch. And that's where my confusion stems from. Not sure if the CA cert should be added in any other default truststore. Please advise. ---
**Author:** ![vee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vee/32/55759_2.png) [@vee](https://discuss.elastic.co/u/vee)\ **Post date:** [June 19, 2023, 2:21pm UTC](https://discuss.elastic.co/t/kibana-watcher-error-throwing-ssl-handshake-even-though-ca-is-same-for-both-kibana-elasticsearch/336256/2 "2023-06-19T14:21:28Z")
Experts - appreciate if you have any suggestions with the above mentioned issue. Thanks for your time! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 17, 2023, 2:21pm UTC](https://discuss.elastic.co/t/kibana-watcher-error-throwing-ssl-handshake-even-though-ca-is-same-for-both-kibana-elasticsearch/336256/3 "2023-07-17T14:21:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.