# Running Rally w/ use\_ssl — how do I pass cert & key info? **URL:** \ **Category:** Elasticsearch\ **Tags:** rally\ **Created:** [April 27, 2017, 10:32pm UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946 "2017-04-27T22:32:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![khyron4eva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khyron4eva/32/35234_2.png) [@khyron4eva](https://discuss.elastic.co/u/khyron4eva)\ **Post date:** [April 27, 2017, 10:32pm UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/1 "2017-04-27T22:32:05Z")
Hello again. After having finally located the docs re: --client-options, I've been trying some invocations with "use\_ssl:true" but they all fail. Rally won't let me disable cert verification so now I'm stuck. I could use some guidance on how to pass both cert and auth information to Rally. When I use curl(1) commands against these clusters, I normally have to specify the "-k", "-u", "--cert" and "--key" flags. How can I pass this information to Rally to pass to the clusters? The ES node (single node cluster) has a cert and key for 2-way SSL but I’m running Rally on a remote node which does not have access to that cert/key pair. Environment is Rally 0.5.3.dev0 on CentOS 6.9 (client & server). ES 1.4.4. Single node cluster. My current Rally command is: esrally --distribution-version=1.4.4 --pipeline=benchmark-only --target-hosts=:9200 --client-options="use\_ssl:true" When I copy the cert file from the ES server to the Rally client and specify the command as follows: --client-options="use\_ssl:true,ca\_cert:///cert.cer" I receive the following error/traceback: . . Traceback (most recent call last): File "/usr/bin/esrally", line 9, in load\_entry\_point('esrally==0.5.3.dev0', 'console\_scripts', 'esrally')() File "/usr/lib/python3.4/site-packages/esrally-0.5.3.dev0-py3.4.egg/esrally/rally.py", line 557, in main client\_options = kv\_to\_map(csv\_to\_list(args.client\_options)) File "/usr/lib/python3.4/site-packages/esrally-0.5.3.dev0-py3.4.egg/esrally/rally.py", line 477, in kv\_to\_map result[k.strip()] = convert(v.strip()) File "/usr/lib/python3.4/site-packages/esrally-0.5.3.dev0-py3.4.egg/esrally/rally.py", line 471, in convert return to\_bool(v) File "/usr/lib/python3.4/site-packages/esrally-0.5.3.dev0-py3.4.egg/esrally/rally.py", line 449, in to\_bool raise ValueError("Could not convert value '%s'" % v) ValueError: Could not convert value ‘///cert.cer' I figure I have to be missing something simple but I haven't found it in the docs yet. Any guidance is most appreciated. Cheers! ---
**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\ **Post date:** [April 28, 2017, 9:56am UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/2 "2017-04-28T09:56:30Z")
Hi @khyron4eva, a couple of things are going wrong here (and I'd blame the docs for this!): 1. You need to enclose string values in single quotes (that's the reason why it complains that it cannot convert the value to a boolean) 2. the key is called `ca_certs` (not the "s" at the end) So I think this should work: `--client-options="use_ssl:true,ca_certs:'/cert.cer'" (provided your certificate is located at`/cert.cer`). It would be great if you could report back if that worked. Then I'll update the docs. A workaround is to disable certificate verification with `verify_certs:false` (the full options are `--client-options="use_ssl:true,verify_certs:false"` in this case). Daniel ---
**Author:** ![khyron4eva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khyron4eva/32/35234_2.png) [@khyron4eva](https://discuss.elastic.co/u/khyron4eva)\ **Post date:** [April 28, 2017, 6:55pm UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/3 "2017-04-28T18:55:27Z")
@danielmitterdorfer, Failed. See below: [claudej@ ~]$ esrally --distribution-version=1.4.4 --pipeline=benchmark-only --target-hosts=:9200 --client-options="use\_ssl:true,verify\_certs:true,ca\_certs:'/home/claudej/rally/cert.cer'" . . [ERROR] Cannot race. ConnectionError(EOF occurred in violation of protocol (\_ssl.c:600)) caused by: SSLError(EOF occurred in violation of protocol (\_ssl.c:600)) . . And as I mentioned, using "verify\_certs:false" tells me it is insecure and won't work: usr/lib/python3.4/site-packages/elasticsearch-5.1.0-py3.4.egg/elasticsearch/connection/http\_urllib3.py:89: UserWarning: Connecting to using SSL with verify\_certs=False is insecure. [ERROR] Cannot race. ConnectionError(EOF occurred in violation of protocol (\_ssl.c:600)) caused by: SSLError(EOF occurred in violation of protocol (\_ssl.c:600)) Cheers! ---
**Author:** ![khyron4eva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khyron4eva/32/35234_2.png) [@khyron4eva](https://discuss.elastic.co/u/khyron4eva)\ **Post date:** [April 28, 2017, 7:21pm UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/4 "2017-04-28T19:21:56Z")
Replying to myself but could this be due to not specifying the key with the cert file? Is there a syntax to do so? I imagine the CA certs are hardcoded into Rally and so I'm not trying to specify those, just the cert & key that clients need to use to talk to ES. ---
**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\ **Post date:** [May 2, 2017, 6:21am UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/5 "2017-05-02T06:21:25Z")
Hi @khyron4eva, thanks for checking. I think this is a real issue then and needs to be fixed. Would you mind [opening an issue on Github](https://github.com/elastic/rally/issues/new)? Thanks! Daniel ---
**Author:** ![khyron4eva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khyron4eva/32/35234_2.png) [@khyron4eva](https://discuss.elastic.co/u/khyron4eva)\ **Post date:** [May 2, 2017, 6:42am UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/6 "2017-05-02T06:42:20Z")
Will do...tomorrow! Cheers! ---
**Author:** ![khyron4eva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khyron4eva/32/35234_2.png) [@khyron4eva](https://discuss.elastic.co/u/khyron4eva)\ **Post date:** [May 2, 2017, 10:50pm UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/7 "2017-05-02T22:50:45Z")
@danielmitterdorfer Opened [https://github.com/elastic/rally/issues/277](https://github.com/elastic/rally/issues/277) Cheers! ---
**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\ **Post date:** [May 3, 2017, 5:47am UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/8 "2017-05-03T05:47:17Z")
Hi @khyron4eva, thanks for opening. I'll see when I can get a fix out. Daniel ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2017, 5:47am UTC](https://discuss.elastic.co/t/running-rally-w-use-ssl-how-do-i-pass-cert-key-info/83946/9 "2017-05-31T05:47:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.