# Switching from cert-util to cert-manager

**URL:** <https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 16, 2022, 2:30pm UTC](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195 "2022-08-16T14:30:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![danksim](https://avatars.discourse-cdn.com/v4/letter/d/a88e57/32.png) [@danksim](https://discuss.elastic.co/u/danksim)\
**Post date:** [August 16, 2022, 2:30pm UTC](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195/1 "2022-08-16T14:30:04Z")

</div>

Elasticsearch version: 7.6.2  
Running it with Helm on AWS EKS

Old setup (v1): `cert-util` is run manually (some makefile/script) before helm install in CI. Not using `InitContainers`

Current setup (v2): helm chart now creates `Certificate` and `Issuer` resources that create the necessary `secret`s using `cert-manager` API

Upgrading from v1 to v2 fails with the following errors:

```auto
"stacktrace": ["io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",

"Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",

"Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",

"Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",

```

If I do a clean install of v2 when either there are no helm releases of this chart or v2 is running, the upgrade works fine. It fails to upgrade only when v1 is running. I suspect there is an issue where `elasticsearch` cannot switch to the new ca/cert.

Has anyone come across this before?

---

<div class="post-metadata">

**Author:** ![danksim](https://avatars.discourse-cdn.com/v4/letter/d/a88e57/32.png) [@danksim](https://discuss.elastic.co/u/danksim)\
**Post date:** [August 31, 2022, 7:52pm UTC](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195/2 "2022-08-31T19:52:50Z")

</div>

Couldn't find a way. Ended up helm deleting and doing a fresh helm install 🤷‍♂️

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2022, 7:53pm UTC](https://discuss.elastic.co/t/switching-from-cert-util-to-cert-manager/312195/3 "2022-09-28T19:53:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.