# P12 certificate is protected by password **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 16, 2018, 6:25pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120 "2018-11-16T18:25:09Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 16, 2018, 6:25pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/1 "2018-11-16T18:25:09Z")
Hi all , My ES cluster containing 3 Master and 2 Data nodes. I have 5 p12 certificates for SSL. All p12 certificates are password protected. May I use these password protected certificates in cluster . When I am enabled SSL by this certificates showing some errors. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 16, 2018, 6:55pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/2 "2018-11-16T18:55:01Z")
Hello, You can definitely use password protected PKCS12 stores with Elasticsearch. See also [our settings reference](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html#_pkcs_12_files_2) Please share some additional information with us: - how did you create these five p12 files - what is the error you're getting This will hopefully enable someone to offer some meaningful feedback and assist you overcoming your problem ! ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 16, 2018, 6:58pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/3 "2018-11-16T18:58:21Z")
These certificates provide from company . With password . They brought from CA companies ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 19, 2018, 7:17am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/4 "2018-11-19T07:17:22Z")
Hi Rijin, Please share the error message you're getting as without this we can only guess and it will be really difficult to assist you in a meaningful way. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 20, 2018, 5:04am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/5 "2018-11-20T05:04:26Z")
Commercially provided PKCS#12 files typically contain cert+key pairs only, and do not contain any trust entries. If you are attempting to use the file as a `truststore` then that is not likely to work. ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 20, 2018, 5:58pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/6 "2018-11-20T17:58:29Z")
My COnf: xpack.security.enabled: true xpack.ssl.keystore.path: /etc/elasticsearch/certs/xyz.p12 xpack.ssl.keystore.type: PKCS12 xpack.ssl.keystore.password: 1b7f669 xpack.ssl.truststore.path: /etc/elasticsearch/certs/xyz.p12 xpack.ssl.truststore.type: PKCS12 xz.p12 and the decryption password 1b7f669 is provided by company. Error log: Caused by: java.io.IOException: keystore password was incorrect at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2059) ~[?:?] at java.security.KeyStore.load(KeyStore.java:1445) ~[?:1.8.0\_181] at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readKeyStore(CertParsingUtils.java:71) ~[?:?] at org.elasticsearch.xpack.core.ssl.CertParsingUtils.trustManager(CertParsingUtils.java:267) ~[?:?] at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:58) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:355) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:388) ~[?:?] at org.elasticsearch.xpack.core.ssl.SSLService.(SSLService.java:92) ~[?:?] at org.elasticsearch.xpack.core.XPackPlugin.(XPackPlugin.java:130) ~[?:?] at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[?:1.8.0\_181] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:598) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:549) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:464) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.plugins.PluginsService.(PluginsService.java:156) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.node.Node.(Node.java:315) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.node.Node.(Node.java:256) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:213) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.4.2.jar:6.4.2] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.4.2.jar:6.4.2] ... 6 more Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 20, 2018, 8:44pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/7 "2018-11-20T20:44:41Z")
You have set `xpack.ssl.keystore.password` but not `xpack.ssl.truststore.password` ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 20, 2018, 10:36pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/8 "2018-11-20T22:36:11Z")
OK. That means remove xpack.ssl.truststore.password ? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 20, 2018, 11:10pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/9 "2018-11-20T23:10:35Z")
No, the configuration file you posted does not have an entry for `xpack.ssl.truststore.password` ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 20, 2018, 11:12pm UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/10 "2018-11-20T23:12:18Z")
Ok Tim. I am checking with new conf. Avoided truststore part ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 21, 2018, 1:12am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/11 "2018-11-21T01:12:46Z")
Hi Tim , I am tried with below mentioning conf. Its working. ( Data node IP:1.2.3.4) xpack.security.enabled: true xpack.ssl.keystore.path: /etc/elasticsearch/certs/xyz.p12 xpack.ssl.keystore.type: PKCS12 xpack.ssl.keystore.password: 1b7f669 But from kibana ... elasticsearch.url: "[https://1.2.3.4:9200](https://1.2.3.4:9200)" is not working. No live connection showing in log. elasticsearch.url: "[http://1.2.3.4:9200](http://1.2.3.4:9200)" is connecting to elasticsearch . Why ? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 21, 2018, 1:47am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/12 "2018-11-21T01:47:47Z")
It appears that you have not enabled TLS on the http port [https://www.elastic.co/guide/en/elasticsearch/reference/6.4/configuring-tls.html#tls-http](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/configuring-tls.html#tls-http) ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 21, 2018, 2:55am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/13 "2018-11-21T02:55:40Z")
Hi TIm when I am added the line "xpack.security.http.ssl.enabled: true" to ES cluster yml files all 3 master nodes and 1 data node working well . but only one data node showing this error io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: ][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [xyzzzz.corp.internal] caught exception while handling client http traffic, closing connection [id: 0x4b6f4330, L:0.0.0.0/0.0.0.0:9200 ! R:/10.142.1.105:58504] ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 21, 2018, 3:30am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/14 "2018-11-21T03:30:36Z")
> [WARN] This is a warning. Warnings can represent something significant, but they typically telling you about something that isn't preventing the cluster from functioning, but may not be working the way you expected/wanted it to. > SecurityNetty4 **Http** ServerTransport This error is relating to HTTP traffic. > not an SSL/TLS record The HTTP interface is expecting SSL requests, but it received something that was not an SSL record. > L:0.0.0.0/0.0.0.0:9200 This was received on port `9200` on the local machine > R:/10.142.1.105:58504 This was received from the **R** emote host: `10.142.1.105` In short, something on 10.142.1.105 is trying to connect over `http` rather than `https`. ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 21, 2018, 3:35am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/15 "2018-11-21T03:35:36Z")
Thanks tim ... 10.142.1.105 is logstash ... I WILL CHANGE logstash outout to https(Now it is http). The "not an SSL/TLS record" issue from kibana connection to Data node. My kibana conf: lasticsearch.ssl.verificationMode: certificate server.ssl.enabled: true server.ssl.certificate: /etc/kibana/certs/xyz.crt server.ssl.key: /etc/kibana/certs/xyz.key Is it ok ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 19, 2018, 3:35am UTC](https://discuss.elastic.co/t/p12-certificate-is-protected-by-password/157120/16 "2018-12-19T03:35:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.