# Trouble enabling SSL for elastic search **URL:** \ **Category:** Elasticsearch\ **Created:** [December 8, 2016, 10:39pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492 "2016-12-08T22:39:32Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![jamesla](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@jamesla](https://discuss.elastic.co/u/jamesla)\ **Post date:** [December 8, 2016, 10:39pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/1 "2016-12-08T22:39:32Z")
I'm trying to enable ssl for the elasticsearch service on tcp 9200 I've followed the instructions using certgen and updating the config here: [https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html](https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html) When I start elasticsearch it starts normally however it is still only functioning with HTTP. When I check the logs there is no mention of any errors at all. Can anybody point me in the right direction on where to look next? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 9, 2016, 4:08am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/2 "2016-12-09T04:08:49Z")
Can you conform you are using Elasticsearch 5.x and have X-Pack installed? If this is the case I would recommend moving this to the X-Pack category. ---
**Author:** ![jamesla](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@jamesla](https://discuss.elastic.co/u/jamesla)\ **Post date:** [December 12, 2016, 1:36am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/3 "2016-12-12T01:36:07Z")
Yes I am using version 5 and have xpack installed - how do I move it to the x-pack cateogry? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 12, 2016, 5:24am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/4 "2016-12-12T05:24:26Z")
I moved it for you. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 13, 2016, 4:49am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/5 "2016-12-13T04:49:49Z")
> Can anybody point me in the right direction on where to look next? Can you post the relevant section of your `elasticsearch.yml` ? It should look something like: ``` xpack: ssl: key: x-pack/ssl/node01/node01.key certificate: x-pack/ssl/node01/node01.crt certificate_authorities: ["x-pack/ssl/ca/ca.crt"] security: http: ssl: enabled: true ``` With that configured, then you should be able to do: ``` curl -k -XGET -u elastic:changeme 'https://localhost:9200/' { "cluster_name" : "elasticsearch", // ... "tagline" : "You Know, for Search" } ``` (that's assuming the default password for the `elastic` user, but hopefully you've changed it to something secure) ---
**Author:** ![jamesla](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@jamesla](https://discuss.elastic.co/u/jamesla)\ **Post date:** [December 13, 2016, 5:34am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/6 "2016-12-13T05:34:58Z")
I have the configuration: xpack.ssl.key: /usr/share/elasticsearch/config/Elasticsearch.key xpack.ssl.certificate: /usr/share/elasticsearch/config/Elasticsearch.crt xpack.ssl.certificate\_authorities: ["usr/share/elasticsearch/config/ca.crt"] xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.enabled: true and the curl you suggested responds with the following error: curl: (35) gnutls\_handshake() failed: An unexpected TLS packet was received. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 13, 2016, 5:59am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/7 "2016-12-13T05:59:26Z")
> xpack.ssl.certificate\_authorities: ["usr/share/elasticsearch/config/ca.crt"] Is that an exact copy of your config? It's missing a leading `/` and that should prevent the server from starting. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 13, 2016, 6:03am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/8 "2016-12-13T06:03:31Z")
My guess, based on the info you've provided so far, is that the file you're editing isn't the one that elasticsearch is reading from. Your config has a typo which _ought_ to prevent the node from starting up, but if the typo is fixed then the config seems fine and SSL should be enabled. What file are you editing, and how are you starting elasticsearch? ---
**Author:** ![jamesla](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@jamesla](https://discuss.elastic.co/u/jamesla)\ **Post date:** [December 13, 2016, 8:28am UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/9 "2016-12-13T08:28:40Z")
Good spotting! However I have changed that and still get the same error. (it looks like an invalid path doesn't cause an error. It's definitely editing the right config file as if I make a mistake elsewhere, it will cease to start. I'm really not sure where else to look? I can't seem to get it to spit out an error message. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 13, 2016, 12:15pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/10 "2016-12-13T12:15:32Z")
> it looks like an invalid path doesn't cause an error I certainly does in `5.0.0`, I can't imagine that the behaviour changed in `5.0.2`, but I'll give it a test tomorrow if we haven't tracked it down. If you're 100% sure that you're editing the correct file, then my best guess is that there's something else weird in your file that's causing it to ignore the xpack configuration. YAML is a complex format with lots of weird stuff that you can do to mess things up if you try hard enough. I suggest you try running your `elasticsearch.yml` file through a YAML parser/validator and check whether it produces the output you expect. There's a few online parsers that will do that job - Google can point you to them. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 13, 2016, 12:22pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/11 "2016-12-13T12:22:03Z")
> [@TimV](#): > > I can't imagine that the behaviour changed in 5.0.2, but I'll give it a test tomorrow if we haven't tracked it down. I just realised that you haven't said precisely which version of ES you're running - I was getting you confused with someone else. What does `bin/elasticsearch --version` give you? ---
**Author:** ![jamesla](https://avatars.discourse-cdn.com/v4/letter/j/3bc359/32.png) [@jamesla](https://discuss.elastic.co/u/jamesla)\ **Post date:** [December 13, 2016, 8:56pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/12 "2016-12-13T20:56:22Z")
Version: 5.0.2, Build: f6b4951/2016-11-24T10:07:18.101Z, JVM: 1.8.0\_111 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 10, 2017, 8:56pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-for-elastic-search/68492/13 "2017-01-10T20:56:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.