# TLS/SSL enabled cluster , SSL is working TSL not working with p12 cert password protected **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 23, 2018, 3:11am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956 "2018-11-23T03:11:49Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 23, 2018, 3:11am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/1 "2018-11-23T03:11:49Z")
Hi All , My ES Cluster is 3 maser and 2 data nodes. In my elastic and kibana conf when i am using SSL conf only its working. i can connect from kibana to ES data node with url [http://ip:9200](http://ip:9200) In the same conf if I am enabling TLS , its not working .... error logs showing. my p12 certificates are protected with passwords . Given by my company. CA in pem format. ``` ES Conf: ``` xpack.security.transport.ssl.certificate\_authorities: ["/etc/elasticsearch/certs/xyz\_Internal\_Issuing\_CA\_2\_G2.pem","/etc/elasticsearch/ certs/xyz\_Internal\_Root\_CA\_G2.pem"] xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certs/nodename.p12 xpack.security.transport.ssl.keystore.password: sffsdfsdg xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: /etc/elasticsearch/certs/nodename.p12 xpack.security.http.ssl.keystore.password: sffsdfsdg ``` Kibana: Conf ``` server.ssl.enabled: true elasticsearch.ssl.verificationMode: certificate server.ssl.certificate: /etc/kibana/certs/79f2ef47dc8494d53bc13f5a285b5f60.crt server.ssl.key: /etc/kibana/certs/79f2ef47dc8494d53bc13f5a285b5f60.key elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/xyz\_Internal\_Issuing\_CA\_2\_G2.pem","/etc/kibana/certs/xyz\_Internal\_Root\_CA\_G2.pem"] ``` ES Log: ``` [2018-11-23T03:06:52,891][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbriceedts01.corp.internal] client did not trust this server's certificate, closing connection NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/10.142.1.110:35870} [2018-11-23T03:06:53,300][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbriceedts01.corp.internal] client did not trust this server's certificate, closing connection NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/10.142.1.109:47844} [2018-11-23T03:06:53,306][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbriceedts01.corp.internal] client did not trust this server's certificate, closing connection NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/10.142.1.111:40458} [2018-11-23T03:06:53,517][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbriceedts01.corp.internal] exception caught on transport layer [NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:41906, remoteAddress=/10.142.1.111:9300}], closing connection io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: General SSLEngine problem at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1359) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:935) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:545) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.16.Final.jar:4.1.16.Final] at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_181] Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1529) ~[?:?] at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [November 23, 2018, 2:58pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/2 "2018-11-23T14:58:39Z")
Typically P12 formatted certificates contain the entire certificate chain, and no `ssl.certificate_authorities` configuration is needed. Please ensure that all intermediate certificates are contained in the certificate file. To check, run: `openssl s_client -connect elasticsearch-host-or-ip:9200` If the P12 files already contain the root CA you can replace the `ssl.certificate_authorities` setting with a [`ssl.truststore.path` setting](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html). ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 23, 2018, 3:46pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/3 "2018-11-23T15:46:43Z")
Hi @Magnus_Kessler , Thanks for your reply . The output is mentioning below. Is there any wrong info ? Some Informations are edited die to privacy and security / > ? CONNECTED(00000003) > depth=0 C = UK, ST = Surrey, L = sdssds, O = Company name, OU = ICE, CN = nodename > verify error:num=20:unable to get local issuer certificate > verify return:1 > depth=0 C = UK, ST = Surrey, L = Weybridge, O = Companyname , OU = ICE, CN = node.name > verify error:num=21:unable to verify the first certificate > verify return:1 * * * > /Certificate chain > 0 s:/C=UK/ST=Surrey/L=Wioijojojj/O=companyname /OU=ICE/CN=nodename > i:/C=UK/ST=Surrey/L=eeeeee/O=yyyyyyyy/OU=PKI/CN=WBA Internal Issuing CA 2 G2 * * * > /Server certificate > -----BEGIN CERTIFICATE----- > zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz > zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz > -----END CERTIFICATE----- > subject=/C=UK/ST=Surrey/L=yy/O=yyy > Alliance/OU=ICE/CN=nodename > issuer=/C=UK/ST=Surrey/L=hkjkje/O=cpmpanyname > /OU=PKI/CN=WBA Internal Issuing CA 2 G2 * * * > /No client certificate CA names sent > Peer signing digest: SHA512 > Server Temp Key: ECDH, P-256, 256 bits * * * > /SSL handshake has read 2285 bytes and written 471 bytes * * * New, TLSv1/SSLv3, Cipher is ECfgggjkk Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : hhhhhhhhh Session-ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Session-ID-ctx: Master-Key: yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1542985677 Timeout : 300 (sec) Verify return code: 21 (unable to verify the first certificate) ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [November 23, 2018, 4:21pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/4 "2018-11-23T16:21:31Z")
Thanks for running that test. So it appears that your Elasticsearch instance successfully starts up a SSL/TLS connection. > [@rijinmp](#): > > In the same conf if I am enabling TLS , its not working To help me understand the issue better, could you please post the configuration changes you are trying to enable `TLS`? Are you talking about this setting? `xpack.ssl.supported_protocols: TLSv1.2` Or is this related to having the `java` client use TLS when connecting to the server? If it is the latter, you need to configure the client with the certificate authority, too. See the [documentation](https://www.elastic.co/guide/en/elastic-stack-overview/6.5/java-clients.html) for more details. ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 23, 2018, 4:26pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/5 "2018-11-23T16:26:38Z")
Not enabled this: xpack.ssl.supported\_protocols: TLSv1.2 If I am enabling only this 🙂 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: /etc/elasticsearch/certs/gbricemtrs01.corp.internal.p12 xpack.security.http.ssl.keystore.password: d5520a5d81b7f669 Then I can connect from kibana by http:elastic-ip:9200 If I am enabling 🙂 xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certs/nodename.p12 xpack.security.transport.ssl.keystore.password: sffsdfsdg Then kibana cant connect: tried [https://elastic-ip:9200](https://elastic-ip:9200) ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [November 23, 2018, 4:40pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/6 "2018-11-23T16:40:59Z")
Please try the following setting and restart the Elasticsearch nodes. It turns TLS verification off at the transport layer. I'd like to check if your issue is related to cluster nodes not being able to talk to each other internally. `xpack.security.transport.ssl.verification_mode: none` ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 26, 2018, 12:03am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/7 "2018-11-26T00:03:44Z")
> [@rijinmp](#): > > when i am using SSL conf only its working. > i can connect from kibana to ES data node with url [http://ip:9200](http://ip:9200) > In the same conf if I am enabling TLS , its not working Can you explain what you mean here? For all practical purposes within Elasticsearch `SSL` and `TLS` are the same thing. They just refer to different versions of the protocol (SSL is the name of older versions, and TLS is the name of the newer versions), but I don't think that is what you mean here. Based on your later responses I think you might perhaps be refering to the difference in enabling SSL/TLS for Elasticsearch's `transport` and `http` ports ? That's definitely not a `SSL` and `TLS` thing, that's `http` and `transport`. The "transport" in the Elasticsearch configuration refers to Elasticsearch's internal network protocol, it has nothing to do with the "transport" in TLS. > [@](#): > > ```auto > 10.142.1.110:35870 > 10.142.1.109:47844 > 10.142.1.111:40458 > > ``` Are those the IP addresses of the nodes in your cluster, or something outside of your cluster? The solution will vary greatly depending on whether you're having an issue with communication between nodes, or from transport client. > [@Magnus\_Kessler](#): > > Typically P12 formatted certificates contain the entire certificate chain, and no `ssl.certificate_authorities` configuration is needed This unfortunately not true. Most corporate and commercially provide PKCS#12 files will only contain key entries, and not trust chain entries. If the P12 was provided by your company, then there's a reasonably chance that the `certificate_authorities` setting is required. > [@rijinmp](#): > > Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem There's almost certainly more to this error message. Can you provide the rest of it - the important part comes after this (I suspect it's going to be `PKIX path building failed: ....`) > [@](#): > > Then kibana cant connect I don't think this is actually an accurate description of what's going on. When you enable SSL/TLS for the `http` port, everything is working. When you enable SSL/TLS for the `transport` port, you are actually breaking your cluster (because the nodes cannot communicate with one another) and so Kibana doesn't work because the cluster is broken, not because it cannot connect. Do you have actual evidence that it cannot connect, or only that it is showing an error. Please, please, please provide actual copy-and-paste of error messages and log files, and don't just guess about what's going on. The types of posts that are most likely to get you answers quickly, are ones that follow a model something like: _When I have **this** configuration [....] then everything works. But when I try **this** configuration [....] then I get **this** error message [....] in Kibana, and my kibana logs say **this** [....] and my elasticsearch logs say **this** [...]_ ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 27, 2018, 4:09am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/8 "2018-11-27T04:09:36Z")
Hi , When I am checked my .p12 certificate , Certificate authority is blank. Is this make any issue? ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 27, 2018, 4:12am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/9 "2018-11-27T04:12:29Z")
My Kibana Conf: server.ssl.enabled: true elasticsearch.ssl.verificationMode: certificate server.ssl.certificate: /etc/kibana/certs/xxxxxx.crt server.ssl.key: /etc/kibana/certs/xxxxx.key elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/CA1.pem","/etc/kibana/certs/CA2.pem"] When I am changed elasticsearch.ssl.verificationMode: certificate to none. Its working . When using certificate ... cant connect. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 27, 2018, 6:39am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/10 "2018-11-27T06:39:17Z")
There are a bunch of questions in my previous post that you haven't answered. If you still need help with this, then you're going to need to provide the information we've asked for. ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 27, 2018, 7:10am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/11 "2018-11-27T07:10:11Z")
Kibana Log: [07:12:50.416] [info][status][plugin:kibana@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.458] [info][status][plugin:elasticsearch@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.462] [info][status][plugin:xpack\_main@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.466] [info][status][plugin:searchprofiler@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.470] [info][status][plugin:ml@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.514] [info][status][plugin:tilemap@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.515] [info][status][plugin:watcher@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.530] [info][status][plugin:license\_management@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.532] [info][status][plugin:index\_management@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.663] [info][status][plugin:timelion@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.665] [info][status][plugin:graph@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.674] [info][status][plugin:monitoring@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.677] [warning][security] Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in kibana.yml log [07:12:50.695] [info][status][plugin:security@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.716] [info][status][plugin:grokdebugger@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.721] [info][status][plugin:dashboard\_mode@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.724] [info][status][plugin:logstash@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:50.740] [info][status][plugin:apm@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.746] [info][status][plugin:console@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.747] [info][status][plugin:console\_extensions@6.4.2] Status changed from uninitialized to green - Ready log [07:12:50.750] [info][status][plugin:notifications@6.4.2] Status changed from uninitialized to green - Ready ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 27, 2018, 7:10am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/12 "2018-11-27T07:10:17Z")
log [07:12:50.753] [info][status][plugin:metrics@6.4.2] Status changed from uninitialized to green - Ready log [07:12:51.172] [warning][reporting] Generating a random key for xpack.reporting.encryptionKey. To prevent pending reports from failing on restart, please set xpack.reporting.encryptionKey in kibana.yml log [07:12:51.174] [info][status][plugin:reporting@6.4.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [07:12:51.225] [info][listening][server][http] Server running at https:///es\_nodename:5601 log [07:12:51.241] [error][admin][elasticsearch] Request error, retrying HEAD https:///es\_nodename:9200/ =\> unable to verify the first certificate log [07:12:51.245] [error][admin][elasticsearch] Request error, retrying HEAD https:///es\_nodename:9200/ =\> unable to verify the first certificate log [07:12:51.266] [warning][admin][elasticsearch] Unable to revive connection: https:///es\_nodename:9200/ log [07:12:51.266] [warning][admin][elasticsearch] No living connections log [07:12:51.269] [warning][admin][elasticsearch] Unable to revive connection: https:///es\_nodename:9200/ log [07:12:51.270] [warning][admin][elasticsearch] No living connections log [07:12:51.271] [error][status][plugin:xpack\_main@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https://es\_nodename:9200/. log [07:12:51.271] [error][status][plugin:searchprofiler@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.272] [error][status][plugin:ml@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.272] [error][status][plugin:tilemap@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.273] [error][status][plugin:watcher@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.273] [error][status][plugin:index\_management@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.274] [error][status][plugin:graph@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.274] [error][status][plugin:security@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodenamel:9200/. log [07:12:51.275] [error][status][plugin:grokdebugger@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.275] [error][status][plugin:logstash@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.276] [error][status][plugin:reporting@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.276] [error][status][plugin:elasticsearch@6.4.2] Status changed from yellow to red - Unable to connect to Elasticsearch at https:///es\_nodename:9200/. log [07:12:51.301] [error][data][elasticsearch] Request error, retrying GET https:///es\_nodename:9200/\_xpack =\> unable to verify the first certificate log [07:12:51.321] [warning][data][elasticsearch] Unable to revive connection: https:///es\_nodename:9200/ log [07:12:51.321] [warning][data][elasticsearch] No living connections log [07:12:51.322] [warning][license][xpack] License information from the X-Pack plugin could not be obtained from Elasticsearch for the [data] cluster. Error: No Living connections log [07:12:51.323] [error][status][plugin:xpack\_main@6.4.2] Status changed from red to red - No Living connections log [07:12:51.323] [error][status][plugin:searchprofiler@6.4.2] Status changed from red to red - No Living connections log [07:12:51.324] [error][status][plugin:ml@6.4.2] Status changed from red to red - No Living connections log [07:12:51.324] [error][status][plugin:tilemap@6.4.2] Status changed from red to red - No Living connections log [07:12:51.325] [error][status][plugin:watcher@6.4.2] Status changed from red to red - No Living connections log [07:12:51.325] [error][status][plugin:index\_management@6.4.2] Status changed from red to red - No Living connections log [07:12:51.326] [error][status][plugin:graph@6.4.2] Status changed from red to red - No Living connections log [07:12:51.326] [error][status][plugin:security@6.4.2] Status changed from red to red - No Living connections log [07:12:51.327] [error][status][plugin:grokdebugger@6.4.2] Status changed from red to red - No Living connections log [07:12:51.327] [error][status][plugin:logstash@6.4.2] Status changed from red to red - No Living connections log [07:12:51.328] [error][status][plugin:reporting@6.4.2] Status changed from red to red - No Living connections ^C ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 27, 2018, 7:14am UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/13 "2018-11-27T07:14:30Z")
ES Log: No changes happening ... remains same - Stopping/Deleting existing jobs, RollupCaps API and RollupSearch continue to function. [2018-11-27T07:04:36,420][INFO][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [es\_nodename] publish\_address {10.142.1.107:9200}, bound\_addresses {10.142.1.107:9200} [2018-11-27T07:04:36,420][INFO][o.e.n.Node] [es\_nodename] started [2018-11-27T07:04:38,689][INFO][o.e.x.w.WatcherService] [es\_nodename] reloading watcher, reason [new local watcher shard allocation ids], cancelled [0] queued tasks ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 30, 2018, 2:41pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/14 "2018-11-30T14:41:06Z")
Can you please help ? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 30, 2018, 4:13pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/15 "2018-11-30T16:13:58Z")
Thanks very much for your interest in Elasticsearch. Please be patient in waiting for responses to your question and refrain from pinging multiple times asking for a response or opening multiple topics for the same question. This is a community forum, it may take time for someone to reply to your question. For more information please refer to the [Community Code of Conduct](https://www.elastic.co/community/codeofconduct) specifically the section "Be patient". If you are in need of a service with an SLA that covers response times for questions then you may want to consider talking to us about a [subscription](https://www.elastic.co/subscriptions). ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 30, 2018, 9:41pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/16 "2018-11-30T21:41:21Z")
Thank you @ikakavas . Can you please check my issue ? ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [November 30, 2018, 9:43pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/17 "2018-11-30T21:43:18Z")
CA is provided by company in the format of .pem . Two .pem format files are provided . ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [December 1, 2018, 5:52pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/18 "2018-12-01T17:52:23Z")
[2018-11-26T15:07:48,338][WARN][o.e.x.s.t.n.SecurityNetty4ServerTransport] [gbricemtrs01.corp.internal] exception caught on transport layer [NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:44648, remoteAddress=gbricemtrs02/10.142.1.110:9300}], closing connection io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: General SSLEngine problem at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1359) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:935) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:545) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-transport-4.1.16.Final.jar:4.1.16.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.16.Final.jar:4.1.16.Final] at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_181] Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1529) ~[?:?] at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) ~[?:?] at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813) ~[?:?] at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781) ~[?:?] at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) ~[?:1.8.0\_181] at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:281) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1215) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] ... 15 more ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [December 1, 2018, 5:52pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/19 "2018-12-01T17:52:44Z")
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[?:?] at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728) ~[?:?] at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:330) ~[?:?] at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322) ~[?:?] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614) ~[?:?] at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:992) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:989) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_181] at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467) ~[?:?] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1364) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1272) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] ... 15 more Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397) ~[?:?] at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) ~[?:?] at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1601) ~[?:?] at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:992) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:989) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_181] at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467) ~[?:?] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1364) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1272) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] ... 15 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) ~[?:?] at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) ~[?:?] at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ~[?:1.8.0\_181] at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392) ~[?:?] at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) ~[?:?] at sun.security.validator.Validator.validate(Validator.java:262) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:?] at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:?] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1601) ~[?:?] at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:?] at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:992) ~[?:?] at sun.security.ssl.Handshaker$1.run(Handshaker.java:989) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0\_181] at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1467) ~[?:?] at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1364) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1272) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[netty-handler-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final] ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [December 1, 2018, 10:06pm UTC](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956/20 "2018-12-01T22:06:51Z")
Please don't post logs as unformatted text as it's very hard to read. Instead paste the text and format it with `` icon, and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer. It would be great if you could edit your previous posts to resolve this. [Next page](https://discuss.elastic.co/t/tls-ssl-enabled-cluster-ssl-is-working-tsl-not-working-with-p12-cert-password-protected/157956.md?page=2)