# Set up basic security for the Elastic Stack plus secured HTTPS traffic

**URL:** https://discuss.elastic.co/t/set-up-basic-security-for-the-elastic-stack-plus-secured-https-traffic/358506
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [April 30, 2024, 4:13pm UTC](https://discuss.elastic.co/t/set-up-basic-security-for-the-elastic-stack-plus-secured-https-traffic/358506 "2024-04-30T16:13:16Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![tneto](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@tneto](https://discuss.elastic.co/u/tneto)
#### Post date: [April 30, 2024, 4:13pm UTC](https://discuss.elastic.co/t/set-up-basic-security-for-the-elastic-stack-plus-secured-https-traffic/358506/1 "2024-04-30T16:13:16Z")

</div>

Hello all.

For the past few days, I have been trying to add the correct certificates to our Elasticsearch and Kibana, but without success.

Long story short, this was not setup by me.  
Neither I was aware of the certificates date until it expired.

The system was using the common certificates that were deployed with the installation I assume:

- http.p12
- transport.p12.

Now I'm trying to create my own certificates.

First step was following this documentation:

> **[Set up basic security for the Elastic Stack | Elasticsearch Guide \[8.13\] |...](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup.html)**

This way I was able to connect to Elasticsearch and get the JSON response on the browser.

Second step was where I started to have errors.

> **[Set up basic security for the Elastic Stack plus secured HTTPS traffic |...](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html)**

So after creating the http.p12 file, I started to have this error:

```auto
[2024-04-30T15:54:46,285][WARN][o.e.h.AbstractHttpServerTransport] [Node Name] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/X.X.0.86:9200, remoteAddress=/X.X.X.X:XXXXX}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

```

These were the configurations:

- Generate a CSR? [y/N] **N**
- Use an existing CA? [y/N] **Y**
- For how long should your certificate be valid? [5y] **3Y**
- node #1 name: **[Same node name as in elasticsearch.yml]**
- [Same node name].[MySite].com
- \*[MySite].com
- X.X.0.86

Key Name: [Node]  
Subject DN: CN=S[Node]  
Key Size: 2048

Do you wish to change any of these options? [y/N] **N**  
Generate additional certificates? [Y/n] **n**

After this I updated my **elasticsearch.yml** file with the following line and moved the http.p12 file to the configuration folder.

```auto
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12

```

I also run this command:

```auto
./bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password

```

I can't solve this error.

Any help?  
What am I missing?

I have Kibana and Elasticsearch in the same server.  
It was running before.

Elasticsearch version: **8.1.3**  
Kibana version: **8.1.3**

Right now I'm only trying to run Elasticsearch.

Thanks.

---

<div class="post-metadata">

### Author: ![tneto](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@tneto](https://discuss.elastic.co/u/tneto)
#### Post date: [May 1, 2024, 6:17pm UTC](https://discuss.elastic.co/t/set-up-basic-security-for-the-elastic-stack-plus-secured-https-traffic/358506/3 "2024-05-01T18:17:49Z")

</div>

I found the issue.  
I had metricbeat running on another server with old certificate.