# Reindex from remote source doesn't work with either API key or user/PW?

**URL:** <https://discuss.elastic.co/t/reindex-from-remote-source-doesnt-work-with-either-api-key-or-user-pw/391123>\
**Category:** Elastic Search\
**Created:** [October 22, 2026, 11:52pm UTC](https://discuss.elastic.co/t/reindex-from-remote-source-doesnt-work-with-either-api-key-or-user-pw/391123 "2026-10-22T23:52:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rik/32/147516_2.png) [@rik](https://discuss.elastic.co/u/rik)\
**Post date:** [October 22, 2026, 11:52pm UTC](https://discuss.elastic.co/t/reindex-from-remote-source-doesnt-work-with-either-api-key-or-user-pw/391123/1 "2026-10-22T23:52:17Z")

</div>

I am trying to move an index from a SRC\_HOST to a TARGET\_HOST.  
I run this command on TARGET\_HOST:

`POST _reindex`  
`{`  
`"source": {`  
`"remote": {`  
`"host": "https:SRC_HOST:9200",`  
`"username": "elastic",`  
`"password": "PW"`  
`},`  
`"index": "pages"`  
`},`  
`"dest": {`  
`"index": "pages"`  
`}`  
`}`

I've also modified `elasticsearch.yml` in the TARGET\_HOST container to include these params:

```auto
reindex.remote.whitelist: ["SRC_HOST:9200"]
reindex.ssl.certificate_authorities: "/usr/share/elasticsearch/config/certs/ca/ca.crt"

```

and copied `ca.crt` from SRC\_HOST to TARGET\_HOST and changed its owner to `elasticsearch`.

but get this error:

`{"type": "s_s_l_handshake_exception",`  
`"reason": "(certificate_unknown) PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors"}`

trying the same command but with `"api_key": "WW5SazFaMEJ...=="`  
instead of user/PW lines, but get the same error.

what am I doing wrong, please?

---

<div class="post-metadata">

**Author:** ![Elliot\_Barlas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elliot_barlas/32/147644_2.png) [@Elliot\_Barlas](https://discuss.elastic.co/u/Elliot_Barlas)\
**Post date:** [October 23, 2026, 6:08am UTC](https://discuss.elastic.co/t/reindex-from-remote-source-doesnt-work-with-either-api-key-or-user-pw/391123/2 "2026-10-23T06:08:32Z")

</div>

The `certificate_unknown` / `PKIX path validation failed` error is from the TLS handshake, which happens before Elasticsearch sends the username, password, or API key. Both attempts failing the same way is expected: the target node is connecting to the source, and it does not trust the certificate the source presents.

`reindex.remote.whitelist` is already working. A whitelist rejection is a different error (`not whitelisted in reindex.remote.whitelist`), and this request got far enough to start TLS.

Trust for remote reindex is configured on the target node, not in the request body. `reindex.ssl.certificate_authorities` has to point at the CA that signed the certificate the source presents on port 9200. Make sure the file the target is reading is the source's CA and not the target's own. Both settings are static, so the target node has to be restarted after `elasticsearch.yml` changes.

You can confirm from inside the TARGET container:

```auto
curl --cacert /usr/share/elasticsearch/config/certs/ca/ca.crt https://SRC_HOST:9200

```

If that fails with a certificate error, that file isn't the CA the source uses. If it succeeds, the file is fine, and the next thing to check is that the target node was restarted with the setting pointing at it.