# ssl.NotSslRecordException **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 31, 2019, 5:18am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655 "2019-05-31T05:18:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![xodn0812](https://avatars.discourse-cdn.com/v4/letter/x/c5a1d2/32.png) [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Post date:** [May 31, 2019, 5:18am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/1 "2019-05-31T05:18:13Z")
I am using elasticsearch version 7.1.0 and trying to connect three nodes with security function, but I receive the following error. It works well locally, but it's a problem at kubernetes. `io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record` elasticsearch is running, but after login is successful in kibana, it goes back to login screen. My security settings are the same with the homepage of elasticsearch. ``` xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.truststore.path: elastic-certificates.p12 xpack.security.http.ssl.keystore.path: elastic-certificates.p12 ``` Reference: [https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html) How can I solve it? ---
**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Post date:** [May 31, 2019, 7:08am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/2 "2019-05-31T07:08:36Z")
when you have a http vs https mismatch, NotSslRecordException usually occurs. Check whether the request is https. ---
**Author:** ![xodn0812](https://avatars.discourse-cdn.com/v4/letter/x/c5a1d2/32.png) [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Post date:** [June 3, 2019, 12:29am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/3 "2019-06-03T00:29:12Z")
Could you put up a simple setup example for security? I do not have access to the 9200 port because I set it up like a question. ---
**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Post date:** [June 3, 2019, 1:17am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/4 "2019-06-03T01:17:17Z")
> [@xodn0812](#): > > xpack.security.http.ssl.enabled: true Maybe you can disable the https to verify if the http request is causing the exception. ---
**Author:** ![xodn0812](https://avatars.discourse-cdn.com/v4/letter/x/c5a1d2/32.png) [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Post date:** [June 3, 2019, 2:34am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/5 "2019-06-03T02:34:50Z")
Yes. I left only the settings below. > network.bind\_host: 0.0.0.0 > network.publish\_host: 0.0.0.0 > xpack.security.enabled: true > xpack.security.transport.ssl.enabled: true > xpack.security.transport.ssl.verification\_mode: certificate > xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 > xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 It works fine locally, > In kubernetes, the following error occurs. > exception caught on transport layer [Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress....... > NotSslRecordException: not an SSL/TLS.............. I tried both of the following settings but it does not work. > discovery.seed\_hosts: > > - [http://myIP](http://myIP) > discovery.seed\_hosts: > > - [https://myIP](https://myIP) In kibana, if login succeeds, it moves to login screen again. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 3, 2019, 2:50am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/6 "2019-06-03T02:50:07Z")
> [@xodn0812](#): > > remoteAddress....... What is this remote Address? Is it part of your k8s cluster? From the `9300` port, it looks like it is another Elasticsearch node trying to connect to this cluster. Do you perhaps have another ES cluster in your k8s cluster without TLS? ---
**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\ **Post date:** [June 3, 2019, 2:53am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/7 "2019-06-03T02:53:46Z")
hi Following is Elasticsearch Doc says: > ``` > org.elasticsearch.common.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: > Indicates that there was incoming plaintext traffic on an SSL connection. This typically occurs when a node is not configured to use encrypted communication and tries to connect to nodes that are using encrypted communication. Please verify that all nodes are using the same setting for `xpack.security.transport.ssl.enabled` . > > ``` As @TimV said, make sure this remote address is the node in your current cluster. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 1, 2019, 2:53am UTC](https://discuss.elastic.co/t/ssl-notsslrecordexception/183655/8 "2019-07-01T02:53:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.