# Problem with elasticsearch-certutil http and "ca certificate is not a CA" error **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 18, 2022, 8:21pm UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949 "2022-07-18T20:21:45Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rlatta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rlatta/32/108481_2.png) [@rlatta](https://discuss.elastic.co/u/rlatta)\ **Post date:** [July 18, 2022, 8:21pm UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949/1 "2022-07-18T20:21:46Z")
Hello, I installed Elasticsearch and Kibana 7.17.5 (windows server 2019). I followed the directions in the "Set up basic security for the Elastic Stack" and didn't run into problems. However, when I move on to the setup basic Plus HTTPS traffic, I get an error at the end of the 'elasticsearch-certutil http' process. Specifically: a "main" java.lang.IllegalArgumentException: ca certificate is not a CA! This happens using the certutil steps from basic. Googling has not helped with this. Any thoughts? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 19, 2022, 12:25am UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949/2 "2022-07-19T00:25:51Z")
The error message is pretty telling: ```auto ca certificate is not a CA! ``` The cert you specified for `elasticsearch-certutil http` cannot be used as a CA (because it has constraint on path length). What file did you specify as CA for the process? Where does it come from? Did you generate it or did you get it from somewhere else? If it is the same `elastic-stack-ca.p12` file from "setup basic security" guide, it should just work. ---
**Author:** ![rlatta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rlatta/32/108481_2.png) [@rlatta](https://discuss.elastic.co/u/rlatta)\ **Post date:** [July 19, 2022, 1:55am UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949/3 "2022-07-19T01:55:25Z")
Thank you Yang\_Wang. I managed to find that during googling. I originally tried it with a Cert issued by the organization I work for however, when it didn't work, I tried the generic one from the "setup basic security" with the same error resulting. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 19, 2022, 2:34am UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949/4 "2022-07-19T02:34:42Z")
> [@rlatta](#): > > I tried the generic one from the "setup basic security" with the same error resulting. How did you create the "generic one"? Is it from running `./bin/elasticsearch-certutil ca`? I cannot reproduce. If you can share your complete command line trail till the point where you have issue, it could be helpful to diagnose this further. ---
**Author:** ![rlatta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rlatta/32/108481_2.png) [@rlatta](https://discuss.elastic.co/u/rlatta)\ **Post date:** [July 19, 2022, 3:54pm UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949/5 "2022-07-19T15:54:41Z")
Doh, that one was on me, I was pointing to the wrong p12 file. Thanks for your help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 16, 2022, 3:54pm UTC](https://discuss.elastic.co/t/problem-with-elasticsearch-certutil-http-and-ca-certificate-is-not-a-ca-error/309949/6 "2022-08-16T15:54:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.