# Setting up TLS/SSL with PEM format CA

**URL:** <https://discuss.elastic.co/t/setting-up-tls-ssl-with-pem-format-ca/218478>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 9, 2020, 7:41pm UTC](https://discuss.elastic.co/t/setting-up-tls-ssl-with-pem-format-ca/218478 "2020-02-09T19:41:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jthoni](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@jthoni](https://discuss.elastic.co/u/jthoni)\
**Post date:** [February 9, 2020, 7:41pm UTC](https://discuss.elastic.co/t/setting-up-tls-ssl-with-pem-format-ca/218478/1 "2020-02-09T19:41:11Z")

</div>

I am trying to set up SSL between the nodes on my cluster. I have ran through the docs at:

[[Encrypting communications in Elasticsearch | Elasticsearch Guide [6.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/configuring-tls.html)]([http://Encrypting](http://Encrypting) communications in Elasticsearch)

I got things to work with P12 certificates. Our policies require us to store all certificates in Azure Key Vault. KV only supports PFX or PEM. I created my CA with the -pem option, it does not ask for a password, and it exports a zip file containing a folder with the ca.crt and ca.key. When I try to create a cert using this as the ca (pointing to the zip, the extracted folder from the zip, or the files within the extracted folder), I get prompted for the password for the CA, though there is none. No matter what I enter I get:

> Exception in thread "main" java.io.IOException: toDerInputStream rejects tag type 45

How can I get this to work using the -pem option for both the CA and the cert?

Thanks,  
~john

---

<div class="post-metadata">

**Author:** ![jthoni](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@jthoni](https://discuss.elastic.co/u/jthoni)\
**Post date:** [February 11, 2020, 4:45pm UTC](https://discuss.elastic.co/t/setting-up-tls-ssl-with-pem-format-ca/218478/3 "2020-02-11T16:45:17Z")

</div>

Looks like I found the answer:

> [Enabling TLS on Elastic Cluster. abcdnvdc | by Shubhmeet Kaur | Medium](https://medium.com/@shubhmeetkaur6/elastic-search-security-a81fc15ce948)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2020, 4:45pm UTC](https://discuss.elastic.co/t/setting-up-tls-ssl-with-pem-format-ca/218478/4 "2020-03-10T16:45:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.