# SSLHandshakeException: Empty server certificate chain

**URL:** <https://discuss.elastic.co/t/sslhandshakeexception-empty-server-certificate-chain/287628>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 25, 2021, 9:29pm UTC](https://discuss.elastic.co/t/sslhandshakeexception-empty-server-certificate-chain/287628 "2021-10-25T21:29:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![porscheme](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@porscheme](https://discuss.elastic.co/u/porscheme)\
**Post date:** [October 25, 2021, 9:29pm UTC](https://discuss.elastic.co/t/sslhandshakeexception-empty-server-certificate-chain/287628/1 "2021-10-25T21:29:51Z")

</div>

ES version: 7.12  
I'm getting this error...any help is really appreciated.

```auto
"Caused by: javax.net.ssl.SSLHandshakeException: Empty server certificate chain",
"at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]",
"at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]",

```

Below are my setting

```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.supported_protocols: TLSv1.2    
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/chain-test-rp-search.pfx
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/chain-test-rp-search.pfx
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.client_authentication: optional
xpack.security.http.ssl.verification_mode: certificate    
xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/chain-test-rp-search-data.pfx
xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/chain-test-rp-search-data.pfx

```

Below is how I make pfx

```auto
openssl pkcs12 -export -out chain-test-rp-search.pfx -inkey test-rp-search.key.pem -in test-rp-search.cert.pem -chain -CAfile chain-test-rp-search.cert.pem -name chain-test-rp-search -passout pass:

openssl pkcs12 -export -out chain-test-rp-search-data.pfx -inkey test-rp-search-data.key.pem -in test-rp-search-data.cert.pem -chain -CAfile chain-test-rp-search.cert.pem -name chain-test-rp-search-data -passout pass:

```

---

<div class="post-metadata">

**Author:** ![porscheme](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@porscheme](https://discuss.elastic.co/u/porscheme)\
**Post date:** [October 26, 2021, 6:50am UTC](https://discuss.elastic.co/t/sslhandshakeexception-empty-server-certificate-chain/287628/2 "2021-10-26T06:50:47Z")

</div>

I wonder how this is working for others?

---

<div class="post-metadata">

**Author:** ![porscheme](https://avatars.discourse-cdn.com/v4/letter/p/dfb087/32.png) [@porscheme](https://discuss.elastic.co/u/porscheme)\
**Post date:** [October 26, 2021, 9:14am UTC](https://discuss.elastic.co/t/sslhandshakeexception-empty-server-certificate-chain/287628/3 "2021-10-26T09:14:48Z")

</div>

I figured it out...the issue was

- PFX file must have a password to have full chain

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 23, 2021, 9:14am UTC](https://discuss.elastic.co/t/sslhandshakeexception-empty-server-certificate-chain/287628/4 "2021-11-23T09:14:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.