# Not able to RUN update-ca-certificates **URL:** \ **Category:** Elasticsearch\ **Tags:** docker\ **Created:** [October 10, 2024, 6:48am UTC](https://discuss.elastic.co/t/not-able-to-run-update-ca-certificates/368597 "2024-10-10T06:48:10Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Pankaj\_Agarwal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_agarwal/32/138234_2.png) [@Pankaj\_Agarwal](https://discuss.elastic.co/u/Pankaj_Agarwal)\ **Post date:** [October 10, 2024, 6:48am UTC](https://discuss.elastic.co/t/not-able-to-run-update-ca-certificates/368597/1 "2024-10-10T06:48:11Z")
Hi, I am facing an error while installing the S3 plugin. It's giving an error for the certificate chain while downloading the S3 zip because I have Zscaler installed on my laptop, and the certificate chain is breaking for HTTPS calls. here is my docker-compose file ```auto services: elastic: build: ./docker/elastic ports: - "9200:9200" ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 environment: discovery.type: "single-node" xpack.security.enabled: "false" ES_JAVA_OPTS: "-Xms512m -Xmx512m -Des.allow_insecure_settings=true" s3.client.default.protocol: "http" s3.client.default.endpoint: "10.0.128.2:9100" networks: - static-network ``` here is my docker file ```auto FROM docker.elastic.co/elasticsearch/elasticsearch:7.10.0 RUN bin/elasticsearch-plugin install repository-s3 --batch RUN bin/elasticsearch-keystore create RUN echo easykey | elasticsearch-keystore add --stdin s3.client.default.access_key RUN echo easysecret | elasticsearch-keystore add --stdin s3.client.default.secret_key RUN elasticsearch-keystore list ``` here is the error ```auto sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) at sun.security.validator.Validator.validate(Validator.java:260) at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491) at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) at sun.security.ssl.Handshaker.process_record(Handshaker.java:914) at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747) at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:138) at SSLPoke.main(SSLPoke.java:31) Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) ``` I tried to install the Zscaler certificate to the elastic image but could not run the command to update the certificate. The same command I am using for my other services that are internally calling HTTPS endpoint and was giving the certificate errors before and the error got resolved here is my docker-compose file ```auto services: elastic: build: ./docker/elastic ports: - "9200:9200" ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 environment: discovery.type: "single-node" xpack.security.enabled: "false" ES_JAVA_OPTS: "-Xms512m -Xmx512m -Des.allow_insecure_settings=true" s3.client.default.protocol: "http" s3.client.default.endpoint: "10.0.128.2:9100" volumes: - ~/.docker/zscaler-cert.cer:/usr/share/elasticsearch/config/certificates/zscaler-cert.cer networks: ``` here is my docker file ```auto FROM docker.elastic.co/elasticsearch/elasticsearch:7.10.0 ## Update the CA certificates USER root RUN update-ca-certificates RUN bin/elasticsearch-plugin install repository-s3 --batch RUN bin/elasticsearch-keystore create RUN echo easykey | elasticsearch-keystore add --stdin s3.client.default.access_key RUN echo easysecret | elasticsearch-keystore add --stdin s3.client.default.secret_key RUN elasticsearch-keystore list ``` ---
**Author:** ![nfeekery](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nfeekery/32/117349_2.png) [@nfeekery](https://discuss.elastic.co/u/nfeekery)\ **Post date:** [October 15, 2024, 3:07pm UTC](https://discuss.elastic.co/t/not-able-to-run-update-ca-certificates/368597/2 "2024-10-15T15:07:16Z")
Category updated on October 15, 2024, 3:07pm UTC From #Elastic Search to #Elasticsearch ---
**Author:** ![Pankaj\_Agarwal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pankaj_agarwal/32/138234_2.png) [@Pankaj\_Agarwal](https://discuss.elastic.co/u/Pankaj_Agarwal)\ **Post date:** [October 19, 2024, 11:05am UTC](https://discuss.elastic.co/t/not-able-to-run-update-ca-certificates/368597/3 "2024-10-19T11:05:03Z")
Team, Any update on this ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 16, 2024, 11:05am UTC](https://discuss.elastic.co/t/not-able-to-run-update-ca-certificates/368597/4 "2024-11-16T11:05:36Z")
Closed on November 16, 2024, 11:05am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.