# SSLHandshakeException

**URL:** <https://discuss.elastic.co/t/sslhandshakeexception/219616>\
**Category:** Elasticsearch\
**Created:** [February 17, 2020, 12:30pm UTC](https://discuss.elastic.co/t/sslhandshakeexception/219616 "2020-02-17T12:30:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chelambarasan\_CR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chelambarasan_cr/32/62592_2.png) [@Chelambarasan\_CR](https://discuss.elastic.co/u/Chelambarasan_CR)\
**Post date:** [February 17, 2020, 12:30pm UTC](https://discuss.elastic.co/t/sslhandshakeexception/219616/1 "2020-02-17T12:30:21Z")

</div>

Getting the below error in Elastic 7.5.1 and readonly rest 1.19.0 version. I am using OSS Elastic and Open source read only rest verification.

SSL and Auth works fine but after enabling **certificate verification** for internode getting the error.The issue is my certificate has only hostname in it for port **9300**. But with the error message it tries to look for ip or it looks for both hostname and ip and it is failing.

[2020-02-14T05:23:02,457][WARN][o.e.t.TcpTransport] [es-data] exception caught on transport layer [Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:40800, remoteAddress= **host1/10.10.10.1:9300}**], closing connection  
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: General SSLEngine problem  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:473) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:281) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:352) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1422) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:374) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:360) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:931) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:700) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:600) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:554) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:514) [netty-transport-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.util.concurrent.SingleThreadEventExecutor$6.run(SingleThreadEventExecutor.java:1050) [netty-common-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.43.Final.jar:4.1.43.Final]  
at java.lang.Thread.run(Thread.java:745) [?:1.8.0\_77]  
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem  
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) ~[?:?]  
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[?:1.8.0\_77]  
at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:280) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1332) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1227) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1274) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:503) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]  
… 16 more  
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem  
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[?:?]  
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728) ~[?:?]  
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304) ~[?:?]  
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) ~[?:?]  
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509) ~[?:?]  
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?]  
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:919) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:916) ~[?:?]  
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_77]  
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369) ~[?:?]  
at io.netty.handler.ssl.SslHandler.runAllDelegatedTasks(SslHandler.java:1502) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1516) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1400) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1227) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1274) ~[netty-handler-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:503) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442) ~[netty-codec-4.1.43.Final.jar:4.1.43.Final]  
… 16 more  
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) ~[?:?]  
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) ~[?:?]  
at sun.security.validator.Validator.validate(Validator.java:260) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?]  
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496) ~[?:?]  
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?]  
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:919) ~[?:?]  
at sun.security.ssl.Handshaker$1.run(Handshaker.java:916) ~[?:?]  
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_77]

Below is the elasticsearch.yml

> ```
> cluster.name: test-stg
> node.data: true
> node.master: true
> action.destructive_requires_name: true
> path.data: /app/elasticsearch/data/ESNode
> path.logs: /app/elasticsearch/logs/ESNode
> action.auto_create_index: true
> bootstrap.memory_lock: false
> #certificate_verification: true
> http.type: ssl_netty4
> transport.type: ror_ssl_internode
> http.port: 9200
> network.host: *eth0*
> network.bind_host: host1
> network.publish_host: host1
> #transport.host: localhost
> transport.tcp.port: 9300
> cluster.routing.allocation.awareness.attributes: rack_fd,rack_ud
> cluster.routing.allocation.awareness.force.rack_fd.values: ‘2,1,0’
> cluster.routing.allocation.awareness.force.rack_ud.values: ‘2,1,0’
> node.attr.rack_fd: ‘0’
> node.attr.rack_ud: ‘0’
> discovery.seed_hosts: host1,host2,host3
> 
> ```

Readonlyrest.yml

> ```
> readonlyrest:
> access_control_rules:
> - name: “Require HTTP Basic Auth”
> type: allow
> auth_key: user:password
> ssl:
> keystore_file: “elastic-ssl.keystore.jks”
> keystore_pass: secret
> key_pass: secret
> ssl_internode:
> keystore_file: “elastic-ssl.keystore.jks”
> keystore_pass: secret
> key_pass: secret
> certificate_verification: true
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2020, 12:30pm UTC](https://discuss.elastic.co/t/sslhandshakeexception/219616/2 "2020-03-16T12:30:27Z")

</div>

Closed on March 16, 2020, 12:30pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.