# SSL between elasticsearch nodes fails

**URL:** <https://discuss.elastic.co/t/ssl-between-elasticsearch-nodes-fails/67082>\
**Category:** Elasticsearch\
**Created:** [November 24, 2016, 9:36am UTC](https://discuss.elastic.co/t/ssl-between-elasticsearch-nodes-fails/67082 "2016-11-24T09:36:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gmachado](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@gmachado](https://discuss.elastic.co/u/gmachado)\
**Post date:** [November 24, 2016, 9:36am UTC](https://discuss.elastic.co/t/ssl-between-elasticsearch-nodes-fails/67082/1 "2016-11-24T09:36:19Z")

</div>

I've deployed a 3 nodes elasticsearch 5.0 cluster and the x-pack 5.0 plugin.

I've created 3 ssl certificates client-server with the same CA and added this lines elasticsearch.yml file :

- xpack.ssl.key: /etc/elasticsearch/x-pack/cert.key
- xpack.ssl.certificate: /etc/elasticsearch/x-pack/cert.crt
- xpack.ssl.certificate\_authorities: ["/etc/elasticsearch/x-pack/ca.crt"]
- xpack.security.transport.ssl.enabled: true

When i start elasticsearch, i have the following error :

```
Caused by: sun.security.validator.ValidatorException: Extended key usage does not permit use for TLS client authentication
	at sun.security.validator.EndEntityChecker.checkTLSClient(EndEntityChecker.java:233) ~[?:?]
	at sun.security.validator.EndEntityChecker.check(EndEntityChecker.java:143) ~[?:?]
	at sun.security.validator.Validator.validate(Validator.java:264) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:279) ~[?:?]
	at sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(X509TrustManagerImpl.java:130) ~[?:?]
	at org.elasticsearch.xpack.ssl.SSLService$ReloadableTrustManager.checkClientTrusted(SSLService.java:539) ~[?:?]
	at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1898) ~[?:?]
	at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:232) ~[?:?]
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:919) ~[?:?]
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:916) ~[?:?]
	at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_112]
	at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369) ~[?:?]
	at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1120) ~[?:?]
	at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1005) ~[?:?]
	at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:900) ~[?:?]
	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:411) ~[?:?]
	... 15 more

```

elasticsearch says my certificate is not a client-server certificate, but openssl confirms it is a client-server certificate :  
X509v3 extensions:  
X509v3 Key Usage: critical  
Digital Signature, Key Encipherment  
X509v3 Extended Key Usage:  
TLS Web Server Authentication, TLS Web Client Authentication  
X509v3 Basic Constraints: critical  
CA:FALSE  
X509v3 Subject Key Identifier:  
68:84:43:13:0E:E0:C9:81:AF:BE:B8:7F:88:32:FF:00:1C:F2:3A:D4  
X509v3 Authority Key Identifier:  
keyid:35:3B:F2:AB:63:5D:B3:8D:22:ED:CA:AB:E1:19:B4:C0:8C:46:DE:FE

Can you help me ?

---

<div class="post-metadata">

**Author:** ![gmachado](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@gmachado](https://discuss.elastic.co/u/gmachado)\
**Post date:** [November 24, 2016, 10:45am UTC](https://discuss.elastic.co/t/ssl-between-elasticsearch-nodes-fails/67082/2 "2016-11-24T10:45:05Z")

</div>

Problem solved 🙂

One certificate node was just a server certificate. I replaced it and the cluster started normally.

---

<div class="post-metadata">

**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\
**Post date:** [December 2, 2016, 12:03am UTC](https://discuss.elastic.co/t/ssl-between-elasticsearch-nodes-fails/67082/3 "2016-12-02T00:03:19Z")

</div>

Glad you were able to figure it out! Thanks for posting your solution.

CJ

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2016, 12:03am UTC](https://discuss.elastic.co/t/ssl-between-elasticsearch-nodes-fails/67082/4 "2016-12-30T00:03:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.