# TLS Certificate Issue on Elastic cluster **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 29, 2019, 10:30am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303 "2019-05-29T10:30:25Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![vivektsb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivektsb/32/49029_2.png) [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Post date:** [May 29, 2019, 10:30am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/1 "2019-05-29T10:30:25Z")
Hi, We are trying to form two node ELK 6.8.0 cluster using procedure mentioned in the following link. [https://www.elastic.co/guide/en/elasticsearch/reference/6.8/configuring-tls.html#node-certificates](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/configuring-tls.html#node-certificates) Generated certificates using bin/x-pack/certutil cert --ca elastic-stack-ca.p12 But getting the following error java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors Regards, Vivek ---
**Author:** ![Askia\_Mohamed\_Kadri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/askia_mohamed_kadri/32/134665_2.png) [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Post date:** [May 29, 2019, 12:11pm UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/2 "2019-05-29T12:11:20Z")
You better generate you certificate with **./elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""** ---
**Author:** ![vivektsb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivektsb/32/49029_2.png) [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Post date:** [May 29, 2019, 1:06pm UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/3 "2019-05-29T13:06:05Z")
Thanks for the quick reply..but still getting the same error... ---
**Author:** ![Askia\_Mohamed\_Kadri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/askia_mohamed_kadri/32/134665_2.png) [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Post date:** [May 29, 2019, 1:49pm UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/4 "2019-05-29T13:49:13Z")
Have you specified `xpack.security.enabled:` `true` `xpack.security.transport.ssl.enabled:` `true` `xpack.security.transport.ssl.verification_mode: certificate` `xpack.security.transport.ssl.keystore.path: elastic-certificates.p12` `xpack.security.transport.ssl.truststore.path: elastic-certificates.p12` In your elasticsearch.yml? If yes, tell me what are the steps to go through to reproduce your error. ---
**Author:** ![vivektsb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivektsb/32/49029_2.png) [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Post date:** [May 30, 2019, 8:48am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/5 "2019-05-30T08:48:28Z")
Since We are installing on ubuntu used command sudo bin/elasticsearch-certutil cert -out /etc/elasticsearch/elastic-certificates.p12 -pass "" and i have set the above settings only in elasticsearch.yml but getting same error ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [May 30, 2019, 10:54am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/6 "2019-05-30T10:54:10Z")
Please provide your exact configuration, and the complete error message from the logs. ---
**Author:** ![vivektsb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivektsb/32/49029_2.png) [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Post date:** [May 30, 2019, 11:03am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/7 "2019-05-30T11:03:50Z")
``` CONFIG: # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluster. # # Please consult the documentation for further information on configuration options: # https://www.elastic.co/guide/en/elasticsearch/reference/index.html # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # cluster.name: cluster-test # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # node.name: cluster-test-2 # # Add custom attributes to the node: # #node.attr.rack: r1 # # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by comma): # path.data: /var/lib/elasticsearch # # Path to log files: # path.logs: /var/log/elasticsearch # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory_lock: true # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # Set the bind address to a specific IP (IPv4 or IPv6): # network.host: xx.xx.xx.xx # # Set a custom port for HTTP: # #http.port: 9200 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when new node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # discovery.zen.ping.unicast.hosts: ["xx.xx.xx.xx", "xx.xx.xx.xx"] # # Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1): # discovery.zen.minimum_master_nodes: 2 # # For more information, consult the zen discovery module documentation. # # ---------------------------------- Gateway ----------------------------------- # # Block initial recovery after a full cluster restart until N nodes are started: # #gateway.recover_after_nodes: 3 # # For more information, consult the gateway module documentation. # # ---------------------------------- Various ----------------------------------- # # Require explicit names when deleting indices: # #action.destructive_requires_name: true xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: cluster-test-2.p12 xpack.security.transport.ssl.truststore.path: cluster-test-2.p12 ``` ---
**Author:** ![vivektsb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivektsb/32/49029_2.png) [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Post date:** [May 30, 2019, 11:04am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/8 "2019-05-30T11:04:06Z")
ERROR: Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:362) ~[?:?] at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:270) ~[?:?] at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1626) ~[?:?] at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) ~[?:?] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_212] at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:?] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1464) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1369) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1203) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1247) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final] ... 15 more Caused by: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:154) ~[?:?] at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:80) ~[?:?] at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292) ~[?:1.8.0\_212] at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:357) ~[?:?] at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:270) ~[?:?] at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1626) ~[?:?] at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) ~[?:?] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_212] at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:?] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1464) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1369) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1203) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1247) ~[netty-handler-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-codec-4.1.32.Final.jar:4.1.32.Final] ... 15 more [2019-05-30T11:02:04,239][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [cluster-test-2] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/xx.xx.xx.xx:34990} [2019-05-30T11:02:04,239][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [cluster-test-2] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/xx.xx.xx.xx:34990} ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 30, 2019, 3:00pm UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/9 "2019-05-30T15:00:02Z")
Please don't post unformatted los and configuration as it's very hard to read. Instead paste the text and format it with \ icon, and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer. It would be great if you could update your post to solve this. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [May 31, 2019, 12:53am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/10 "2019-05-31T00:53:20Z")
> [@vivektsb](#): > > Generated certificates using > bin/x-pack/certutil cert --ca elastic-stack-ca.p12 Did you do this _once_ and then copy the PKCS#12 file to each node, or did you generate a new set of certificates on each node? ---
**Author:** ![vivektsb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivektsb/32/49029_2.png) [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Post date:** [May 31, 2019, 8:22am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/11 "2019-05-31T08:22:31Z")
I generated new set of certificates on each node... ---
**Author:** ![vivektsb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivektsb/32/49029_2.png) [@vivektsb](https://discuss.elastic.co/u/vivektsb)\ **Post date:** [May 31, 2019, 11:54am UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/12 "2019-05-31T11:54:52Z")
I have copied same certificate across all nodes and tried now the cluster formed...Thank you ... ---
**Author:** ![Askia\_Mohamed\_Kadri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/askia_mohamed_kadri/32/134665_2.png) [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Post date:** [June 3, 2019, 12:30pm UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/13 "2019-06-03T12:30:43Z")
Glad it worked ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 1, 2019, 12:30pm UTC](https://discuss.elastic.co/t/tls-certificate-issue-on-elastic-cluster/183303/14 "2019-07-01T12:30:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.