# Troubleshooting "bad certificate" shield 2.3.1

**URL:** <https://discuss.elastic.co/t/troubleshooting-bad-certificate-shield-2-3-1/47874>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 20, 2016, 8:08am UTC](https://discuss.elastic.co/t/troubleshooting-bad-certificate-shield-2-3-1/47874 "2016-04-20T08:08:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Baboune](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baboune/32/4405_2.png) [@Baboune](https://discuss.elastic.co/u/Baboune)\
**Post date:** [April 20, 2016, 8:08am UTC](https://discuss.elastic.co/t/troubleshooting-bad-certificate-shield-2-3-1/47874/1 "2016-04-20T08:08:41Z")

</div>

Hi,

We are trying to setup TLS/SSL.

We are using Elastic 2.3.1 and shield 2.3.1. We have a trusted certificate, a trustore and a keystore. The different elastic nodes are handshaking. The problem is that the browser (or external HTTPs queries) return “bad certificate”.

> [2016-04-20 07:52:12,988][WARN][shield.transport.netty] [datastorage] Caught exception while handling client http traffic, closing connection [id: 0x4554e2e1, /172.17.0.1:37040 =\> /172.17.0.2:9200]  
> javax.net.ssl.SSLException: Received fatal alert: bad\_certificate  
> at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)  
> at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)  
> at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)  
> at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800)  
> at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083)  
> at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907)  
> at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)  
> at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)  
> at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)  
> at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)  
> at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)  
> at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)  
> at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
> at org.jboss.netty.handler.ipfilter.IpFilteringHandlerImpl.handleUpstream(IpFilteringHandlerImpl.java:154)  
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)  
> at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)  
> at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)  
> at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)  
> at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)  
> at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)  
> at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)  
> at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)  
> at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)  
> at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  
> at java.lang.Thread.run(Thread.java:745)

We tried to turn on SSL/TLS java debug see [Debugging SSL/TLS connections](http://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/ReadDebug.html), but the flag –Djavax.net.debug=all makes no difference to the elastic output.

We are now trying wireshark.

How can we troubleshoot SSL/TLS further?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/troubleshooting-bad-certificate-shield-2-3-1/47874/2 "2017-07-06T13:45:14Z")

</div>