# SSLHandshakeException: no cipher suites in common **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [June 3, 2019, 10:07am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929 "2019-06-03T10:07:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![anon17386273](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Post date:** [June 3, 2019, 10:07am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929/1 "2019-06-03T10:07:17Z")
[https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls.html#node-certificates](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls.html#node-certificates) Hi, I have a 3 node cluster, trying to setup the TLS security using the link above. Without enabling the below configs, the cluster is able to discover each other ```auto xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: /opt/elasticsearch/config/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /opt/elasticsearch/config/elastic-certificates.p12 ``` After enabling, all 3 nodes complain: "SSLHandshakeException: no cipher suites in common" These are the steps that i did on each node 1. generate cert using elasticsearch-certutil, placed them in config folder 2. add the 4 lines of xpack command into elasticsearch.yml Anyone know what does this mean? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 3, 2019, 3:49pm UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929/2 "2019-06-03T15:49:21Z")
The error message means that a client in a TLS handshake couldn't agree on a mutually supported cipher suite. This can be misleading , as it can also happen in the context of Java when one of the two is configured with no available keys for TLS. Can you share with us: - The exact command that you used to create the `PKCS#12` files - The output of `openssl -in /opt/elasticsearch/config/elastic-certificates.p12 -info` - The logs ( The exception stacktraces ) from a couple of your nodes. ---
**Author:** ![anon17386273](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Post date:** [June 4, 2019, 2:56am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929/3 "2019-06-04T02:56:55Z")
command ran on all 3 nodes `/opt/elasticsearch/bin/elasticsearch-certutil cert --out /opt/elasticsearch/config/elastic-certificates.p12 --pass ""` I can't generate any output from command `openssl -in /opt/elasticsearch/config/elastic-certificates.p12 -info`. Do you need all three nodes? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 4, 2019, 3:34am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929/4 "2019-06-04T03:34:17Z")
I cannot explain why you are getting a cipher suites error, but the problem here is that you ran that command on each node. You skipped step 1 which creates a single CA for your cluster. Because you didn't do that step the `/opt/elasticsearch/bin/elasticsearch-certutil cert` command generated a new CA each time you ran it, which will not work. If you are going to use `/opt/elasticsearch/bin/elasticsearch-certutil cert` without first generating a CA, then you need to run it _once_ and then copy that certificate keystore to each node. ---
**Author:** ![anon17386273](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Post date:** [June 4, 2019, 6:05am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929/5 "2019-06-04T06:05:01Z")
Hi Tim Thanks for replying. I have included the step to generate one CA, transfer the CA to all three nodes and ran the following command: `/opt/elasticsearch/bin/elasticsearch-certutil cert --ca /etc/elasticsearch/elastic-stack-ca.p12 --ca-pass "" --out /opt/elasticsearch/config/elastic-certificates.p12 --pass ""` Sadly, after restarting all 3 nodes, they were still complain: "SSLHandshakeException: no cipher suites in common" ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [June 4, 2019, 6:21am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929/6 "2019-06-04T06:21:58Z")
Can you provide the complete error message from the log, including the stack trace please. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 2, 2019, 6:22am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-cipher-suites-in-common/183929/7 "2019-07-02T06:22:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.