# New install - error setting certificate verify locations
**URL:** https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [June 16, 2022, 10:43pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455 "2022-06-16T22:43:42Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@BRosenberg](https://discuss.elastic.co/u/BRosenberg)
#### Post date: [June 16, 2022, 10:43pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/1 "2022-06-16T22:43:42Z")
Following the instructions here: [Install Elasticsearch with Debian Package | Elasticsearch Guide [8.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.2/deb.html)
Installing from apt on Ubuntu server 20.04
```auto
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
sudo apt-get install apt-transport-https
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
sudo apt-get update
sudo apt-get install elasticsearch
```
I get a normal looking output for "Security autoconfiguration information" including a password for the elastic user. I have not changed any files from their default.
```auto
sudo systemctl start elasticsearch.service
```
Starts without errors, no errors in the log that I can find, so I believe Elasticsearch started cleanly but when I run:
```auto
curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
```
Result is an error:
```auto
Enter host password for user 'elastic':
curl: (77) error setting certificate verify locations:
CAfile: /etc/elasticsearch/certs/http_ca.crt
CApath: /etc/ssl/certs
```
If I run the same command with the -k flag
```auto
curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200 -k
```
results in the below so I'm wondering what I missed, or where to go from here since I haven't done anything different from the stated instructions?
```auto
{
"name" : "elk",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "Oby40z63Sn6G9RS_V9zuvg",
"version" : {
"number" : "8.2.3",
"build_flavor" : "default",
"build_type" : "deb",
"build_hash" : "9905bfb62a3f0b044948376b4f607f70a8a151b4",
"build_date" : "2022-06-08T22:21:36.455508792Z",
"build_snapshot" : false,
"lucene_version" : "9.1.0",
"minimum_wire_compatibility_version" : "7.17.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "You Know, for Search"
```
---
### Author:  [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)
#### Post date: [June 17, 2022, 1:53am UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/2 "2022-06-17T01:53:04Z")
Hello @BRosenberg
Welcome to Elastic Community 🙂 !!!
Could you execute the below command and let us know the result. I hope this might fix your issue.
`echo 'cacert=/etc/ssl/certs/http_ca.crt' > ~/.curlrc`
---
### Author:  [@BRosenberg](https://discuss.elastic.co/u/BRosenberg)
#### Post date: [June 17, 2022, 3:41am UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/3 "2022-06-17T03:41:46Z")
Hi, and thanks for the welcome.
I ran the command you suggested and then tried the curl command again, but still got the same result:
```auto
:~$ curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
curl: (77) error setting certificate verify locations:
CAfile: /etc/elasticsearch/certs/http_ca.crt
CApath: /etc/ssl/certs
```
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [June 17, 2022, 1:38pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/5 "2022-06-17T13:38:54Z")
I reproduced the issue on Ubuntu 22.04. Can you check this? It looks like a permission issue on my system, so I am wondering if you have the same issue.
```auto
$ ls -l /etc/elasticsearch/certs/http_ca.crt
ls: cannot access '/etc/elasticsearch/certs/http_ca.crt': Permission denied
```
On my Ubuntu system, /etc/Elasticsearch was created without global read/execute permission.
```auto
$ ls -l /etc | grep elasticsearch
drwxr-s--- 4 root elasticsearch 4096 Jun 17 09:21 elasticsearch
$ ls -l /var/log | grep elasticsearch
drwxr-s--- 2 elasticsearch elasticsearch 4096 Jun 17 09:29 elasticsearch
```
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [June 17, 2022, 2:14pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/6 "2022-06-17T14:14:00Z")
A quick workaround could be:
```auto
chmod a+rx /etc/elasticsearch/ /etc/elasticsearch/certs
chmod a+r /etc/elasticsearch/certs/http_ca.crt
```
Be careful to not give global read permissions to sensitive files in those directories, such as `elasticsearch.keystore`.
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [June 17, 2022, 2:28pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/7 "2022-06-17T14:28:01Z")
Another option could be to add `/etc/elasticsearch/certs/http_ca.crt` to the default location used by curl.
```auto
sudo apt install curl-config
sudo curl-config --configure
sudo cp /etc/elasticsearch/certs/http_ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
```
---
### Author:  [@BRosenberg](https://discuss.elastic.co/u/BRosenberg)
#### Post date: [June 17, 2022, 3:11pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/8 "2022-06-17T15:11:32Z")
> [@Justin\_Cranford](#):
>
> A quick workaround could be:
>
> ```auto
> chmod a+rx /etc/elasticsearch/ /etc/elasticsearch/certs
> chmod a+r /etc/elasticsearch/certs/http_ca.crt
>
> ```
>
> Be careful to not give global read permissions to sensitive files in those directories, such as `elasticsearch.keystore`.
This appears to have worked for me. curl is returning the expected results now.
Looking at the permissions on my Ubuntu 20.04 install, I was getting the same as you. Appears no permissions were set for 'others'. Not sure if that's an Ubuntu-specific thing or if that's just not considered in the .deb install.
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [June 17, 2022, 6:18pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/9 "2022-06-17T18:18:38Z")
I am happy to hear it is working for you now.
I have a note to follow up on the .deb install permissions.
Thank you.
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [June 20, 2022, 8:05pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/10 "2022-06-20T20:05:30Z")
Hello. I opened a bug report in GitHub to track this problem. You can track progress there. Thank you!
>
>
> \### Elasticsearch Version
>
> 8.2.2
>
> \### Installed Plugins
>
> \_No response\_
>
> …### Java Version
>
> \_bundled\_
>
> \### OS Version
>
> Ubuntu 20.04 LTS, and
> Ubuntu 22.04 LTS (Linux ncc-1701-d 5.15.0-39-generic #42-Ubuntu SMP Thu Jun 9 23:42:32 UTC 2022 x86\_64 x86\_64 x86\_64 GNU/Linux)
>
> \### Problem Description
>
> I reproduced a \`Security on by default\` issue in \[Discuss\](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455) related to Ubuntu/Debian install.
> \- https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455
>
> HTTPS certs (CA and server) are generated at install time. However, they are placed in a directory with no global read permission. Non-privileged users cannot access the HTTPS CA cert for use in HTTPS clients (ex: curl).
>
> This seems like an install issue for how permissions are setup during install.
>
> \### Steps to Reproduce
>
> Install and Run Elasticsearch (as per \[the Discuss problem description\](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455))
> \`\`\`
> wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
> sudo apt-get install apt-transport-https
> echo "deb \[signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg\] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
> sudo apt-get update
> sudo apt-get install elasticsearch
> sudo systemctl start elasticsearch.service
> \`\`\`
>
> Reproduce the permissions issue with \`curl\`
> \`\`\`
> $ curl --cacert /etc/elasticsearch/certs/http\_ca.crt -u elastic https://localhost:9200/
> curl: (77) error setting certificate file: /etc/elasticsearch/certs/http\_ca.crt
> \`\`\`
>
> Demonstrate the permissions issue with \`ls\`
> \`\`\`
> $ ls -l /etc/elasticsearch/certs/http\_ca.crt
> ls: cannot access '/etc/elasticsearch/certs/http\_ca.crt': Permission denied
>
> $ ls -l /etc | grep elasticsearch
> drwxr-s--- 4 root elasticsearch 4096 Jun 17 09:21 elasticsearch
>
> $ ls -l /var/log | grep elasticsearch
> drwxr-s--- 2 elasticsearch elasticsearch 4096 Jun 17 09:29 elasticsearch
> \`\`\`
>
> \### Logs (if relevant)
>
> n/a
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2022, 8:06pm UTC](https://discuss.elastic.co/t/new-install-error-setting-certificate-verify-locations/307455/11 "2022-07-18T20:06:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.