Reindex from remote source doesn't work with either API key or user/PW?

Elastic Search
1

I am trying to move an index from a SRC_HOST to a TARGET_HOST.
I run this command on TARGET_HOST:

POST _reindex
{
"source": {
"remote": {
"host": "https:SRC_HOST:9200",
"username": "elastic",
"password": "PW"
},
"index": "pages"
},
"dest": {
"index": "pages"
}
}

I've also modified elasticsearch.yml in the TARGET_HOST container to include these params:

reindex.remote.whitelist: ["SRC_HOST:9200"]
reindex.ssl.certificate_authorities: "/usr/share/elasticsearch/config/certs/ca/ca.crt"

and copied ca.crt from SRC_HOST to TARGET_HOST and changed its owner to elasticsearch.

but get this error:

{"type": "s_s_l_handshake_exception",
"reason": "(certificate_unknown) PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors"}

trying the same command but with "api_key": "WW5SazFaMEJ...=="
instead of user/PW lines, but get the same error.

what am I doing wrong, please?

2

The certificate_unknown / PKIX path validation failed error is from the TLS handshake, which happens before Elasticsearch sends the username, password, or API key. Both attempts failing the same way is expected: the target node is connecting to the source, and it does not trust the certificate the source presents.

reindex.remote.whitelist is already working. A whitelist rejection is a different error (not whitelisted in reindex.remote.whitelist), and this request got far enough to start TLS.

Trust for remote reindex is configured on the target node, not in the request body. reindex.ssl.certificate_authorities has to point at the CA that signed the certificate the source presents on port 9200. Make sure the file the target is reading is the source's CA and not the target's own. Both settings are static, so the target node has to be restarted after elasticsearch.yml changes.

You can confirm from inside the TARGET container:

curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt https://SRC_HOST:9200

If that fails with a certificate error, that file isn't the CA the source uses. If it succeeds, the file is fine, and the next thing to check is that the target node was restarted with the setting pointing at it.