# Trying to set up TLS on Elastic CLuster

**URL:** <https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323>\
**Category:** Elasticsearch\
**Created:** [August 7, 2018, 12:32pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323 "2018-08-07T12:32:26Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![bigdamhero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigdamhero/32/34478_2.png) [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\
**Post date:** [August 7, 2018, 12:32pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/1 "2018-08-07T12:32:26Z")

</div>

I'm getting an error in the java log.  
Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/usr/share/elasticsearch/config/certs/elastic-node-tls-ca.p12" "read")

Checking the permissions it looks like the elasticsearch group has read access. The file is owned by root. What should I change to allow elasticsearch to have access to it and keep it secure. 🕶

---

<div class="post-metadata">

**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\
**Post date:** [August 7, 2018, 1:03pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/2 "2018-08-07T13:03:25Z")

</div>

@bigdamhero can you please confirm that the file is under the elasticsearch config dir? In configuration do you use relative paths?

---

<div class="post-metadata">

**Author:** ![bigdamhero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigdamhero/32/34478_2.png) [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\
**Post date:** [August 7, 2018, 1:06pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/3 "2018-08-07T13:06:36Z")

</div>

Thanks for the reply Albert! I am a little unsure about the relative path.

I created a directory /config..

Here is my entry from my .yml  
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-node-tls-ca.p12

Should that be shortened? If so what should It look like?  
Thanks again!!

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 7, 2018, 2:29pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/4 "2018-08-07T14:29:13Z")

</div>

When you start Elasticsearch, near the top of the log there should be a message that says something like:

```auto
[2018-08-07T01:01:01,000][INFO][o.e.n.Node] JVM arguments [...]

```

In that log entry, what is`-Des.path.conf` set to?

---

<div class="post-metadata">

**Author:** ![bigdamhero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigdamhero/32/34478_2.png) [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\
**Post date:** [August 7, 2018, 3:21pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/5 "2018-08-07T15:21:54Z")

</div>

-Des.path.conf=/etc/elasticsearch,

Is that where the config folder "should" be?

---

<div class="post-metadata">

**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\
**Post date:** [August 7, 2018, 3:43pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/6 "2018-08-07T15:43:54Z")

</div>

> Is that where the config folder "should" be?

It can bee anywhere you like. BUT from [Encrypting Communications in Elasticsearch | Elasticsearch Reference [6.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/configuring-tls.html#node-certificates)

> Copy the applicable .p12 file into a directory within the Elasticsearch configuration directory on each node.

Therefore, the problem is that `/usr/share/elasticsearch/config/certs/elastic-node-tls-ca.p12` is not under `/etc/elasticsearch` . Either change `-Des.path.conf` to `/usr/share/elasticsearch/config` or move `elastic-node-tls-ca.p12` under whatever path es.path.conf points to.

This is a security feature to confine the java process under a path jail.

---

<div class="post-metadata">

**Author:** ![bigdamhero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigdamhero/32/34478_2.png) [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\
**Post date:** [August 7, 2018, 4:47pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/7 "2018-08-07T16:47:13Z")

</div>

That makes perfect sense. I moved the files to live under /ect/elasticsearch. On to the next error.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2018, 4:47pm UTC](https://discuss.elastic.co/t/trying-to-set-up-tls-on-elastic-cluster/143323/8 "2018-09-04T16:47:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.