# TSL/SSL failing elastic not working

**URL:** <https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 12, 2018, 1:59pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299 "2018-11-12T13:59:40Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 12, 2018, 1:59pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/1 "2018-11-12T13:59:40Z")

</div>

I have problem understanding some entries in the elasticsearch.yml file

in perticalar the `xpack.security.transport.ssl.certificate_authorities` entry

_elasticsearch.yml_

```auto
cluster.name: "docker-cluster"
network.host: 0.0.0.0

# minimum_master_nodes need to be explicitly set when bound on a public IP
# set to 1 to allow single node clusters
# Details: https://github.com/elastic/elasticsearch/pull/17288
discovery.zen.minimum_master_nodes: 1
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/certs/elasticsearch.key.pem
xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/certs/elasticsearch.cert.pem
xpack.security.transport.ssl.certificate_authorities:
  - /usr/share/elasticsearch/config/certs/ca-chain.cert.pem

```

I have created and validated the keys and certificates with openssl (`openssl validate`)  
There is one thing that is not clear of the docs, and i made an educated guess

_the value of `xpack.security.transport.ssl.certificate_authorities`_

i cancatenated the the root ca and intermediate ca to one file (chain of trust) like os

```auto
cat intermediate/certs/intermediate.cert.pem \
      certs/ca.cert.pem > intermediate/certs/ca-chain.cert.pem
chmod 444 intermediate/certs/ca-chain.cert.pem

```

I did use this chain to validate the signed server certificated i created (and signed)

```auto
openssl verify -CAfile intermediate/certs/ca-chain.cert.pem intermediate/certs/elasticsearch.cert.pem

intermediate/certs/elasticsearch.cert.pem: OK

```

I used the `ca-chain.cert.pem` as a value for `xpack.security.transport.ssl.certificate_authorities`

is this correct???

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 12, 2018, 2:07pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/2 "2018-11-12T14:07:10Z")

</div>

i wanted to add this

`http://localhost:9200/_xpack/ssl/certificates`

it does seem to "see" the certificates and its content" (some fields obfuscated)

[  
{  
"path": "/usr/share/elasticsearch/config/certs/ca-chain.cert.pem",  
"format": "PEM",  
"alias": null,  
"subject\_dn": "EMAILADDRESS=xxxxx, CN=elasticsearch, OU=streaming, O=companyx, L=Luxembourg-ville, ST=Luxembourg, C=LU",  
"serial\_number": "e7c7414bc8883115",  
"has\_private\_key": false,  
"expiry": "2038-11-07T12:03:17.000Z"  
},  
{  
"path": "/usr/share/elasticsearch/config/certs/elasticsearch.cert.pem",  
"format": "PEM",  
"alias": null,  
"subject\_dn": "EMAILADDRESS=xxxxx, [CN=elasticsearch.com](http://CN=elasticsearch.com), OU=streaming, O=companyx, L=Luxembourg-ville, ST=Luxembourg, C=LU",  
"serial\_number": "6517",  
"has\_private\_key": true,  
"expiry": "2019-11-22T12:54:06.000Z"  
},  
{  
"path": "/usr/share/elasticsearch/config/certs/ca-chain.cert.pem",  
"format": "PEM",  
"alias": null,  
"subject\_dn": "EMAILADDRESS=xxxxx, CN=elastic intermediate, OU=streaming, O=companyx, ST=Luxembourg, C=LU",  
"serial\_number": "2740",  
"has\_private\_key": false,  
"expiry": "2028-11-09T12:35:02.000Z"  
}  
]

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 12, 2018, 3:02pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/3 "2018-11-12T15:02:52Z")

</div>

I made some progess...

excuse, i cant still make it work

```auto
$ curl -XGET https://elasticsearch.com:9200/_xpack/ssl/certificates
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

```

So the only issue is to have kibana talk to elastic with https

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 12, 2018, 4:33pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/6 "2018-11-12T16:33:06Z")

</div>

What license do you have installed?

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 12, 2018, 5:02pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/7 "2018-11-12T17:02:02Z")

</div>

trial license (we are evaluating elastic), its still active

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 12, 2018, 5:04pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/8 "2018-11-12T17:04:59Z")

</div>

i tested the certificates in nodejs and curl, also validated them with openssl

```auto
const https = require('https');
const fs = require('fs');

const options = {
  key: fs.readFileSync('./localhost.key.pem'), // created key with CN (localhost, but signed by the same intermediate ca)
  cert: fs.readFileSync('./localhost.cert.pem') // created key with CN (localhost, but signed by the same Intermediate CA)
};

https.createServer(options, (req, res) => {
  console.log('replying....')
  res.writeHead(200);
  res.end('hello world\n');
}).listen(8000);

```

I used curl with the -cacert option (worked)

```auto
$ curl https://localhost:8000 --cacert ca-chain.cert.pem
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
100 12 0 12 0 0 12 0 --:--:-- --:--:-- --:--:-- 48hello world

```

PS: Am i using the confing option `xpack.security.transport.ssl.certificate_authorities` correctly? I am not sure

our elasticsearch.yml looks like this

```auto
cluster.name: "docker-cluster"
network.host: 0.0.0.0

# minimum_master_nodes need to be explicitly set when bound on a public IP
# set to 1 to allow single node clusters
# Details: https://github.com/elastic/elasticsearch/pull/17288
discovery.zen.minimum_master_nodes: 1
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/certs/elasticsearch.key.pem
xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/certs/intermediate.ca.cert.pem
xpack.security.transport.ssl.certificate_authorities:
  - /usr/share/elasticsearch/config/certs/intermediate.ca.cert.pem
  - /usr/share/elasticsearch/config/certs/root.ca.cert.pem

```

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 13, 2018, 4:57pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/11 "2018-11-13T16:57:56Z")

</div>

certificates via rest api (company an name info replace with "xxxx")

```auto
[
  {
    "path": "/usr/share/elasticsearch/config/certs/elasticsearch.com.cert.pem",
    "format": "PEM",
    "alias": null,
    "subject_dn": "EMAILADDRESS=xxxx, CN=elasticsearch.com, OU=streaming, O=xxxx, L=Luxembourg-ville, ST=Luxembourg, C=LU",
    "serial_number": "651b",
    "has_private_key": true,
    "expiry": "2019-11-23T12:48:30.000Z"
  },
  {
    "path": "/usr/share/elasticsearch/config/certs/intermediate.cert.pem",
    "format": "PEM",
    "alias": null,
    "subject_dn": "EMAILADDRESS=xxxxxxx, CN=elastic intermediate, OU=streaming, O=xxxxx, ST=Luxembourg, C=LU",
    "serial_number": "2741",
    "has_private_key": false,
    "expiry": "2028-11-10T10:36:01.000Z"
  },
  {
    "path": "/usr/share/elasticsearch/config/certs/ca.cert.pem",
    "format": "PEM",
    "alias": null,
    "subject_dn": "EMAILADDRESS=xxxx, CN=root ca to sign elastic nodes, OU=streaming, O=xxxx, L=Luxembourg-ville, ST=Luxembourg, C=LU",
    "serial_number": "be0d48402d376d76",
    "has_private_key": false,
    "expiry": "2038-11-08T09:22:30.000Z"
  }
]

```

elasticsearch startup logs , looks ok,

```auto
elasticsearch.com | [2018-11-13T16:23:32,153][INFO][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [e9qmioL] publish_address {172.18.0.2:9200}, bound_addresses {0.0.0.0:9200}
elasticsearch.com | [2018-11-13T16:23:32,154][INFO][o.e.n.Node] [e9qmioL] started
elasticsearch.com | [2018-11-13T16:23:32,695][INFO][o.e.l.LicenseService] [e9qmioL] license [d9edf7ec-75a5-4151-86d1-9ed115259ece] mode [basic] - valid

```

elasticsearch.yml configuration

```auto
cluster.name: "docker-cluster"
network.host: 0.0.0.0

# minimum_master_nodes need to be explicitly set when bound on a public IP
# set to 1 to allow single node clusters
# Details: https://github.com/elastic/elasticsearch/pull/17288
discovery.zen.minimum_master_nodes: 1
xpack.security.enabled: false
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/certs/elasticsearch.com.key.pem
xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/certs/elasticsearch.com.cert.pem
xpack.security.transport.ssl.certificate_authorities:
  - /usr/share/elasticsearch/config/certs/intermediate.cert.pem
  - /usr/share/elasticsearch/config/certs/ca.cert.pem

```

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 13, 2018, 4:59pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/12 "2018-11-13T16:59:44Z")

</div>

with all the good looking logs above, i still get this

```auto
$ curl -XGET https://elasticsearch.com:9200
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

```

---

<div class="post-metadata">

**Author:** ![jacobot](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jacobot](https://discuss.elastic.co/u/jacobot)\
**Post date:** [November 13, 2018, 5:49pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/13 "2018-11-13T17:49:50Z")

</div>

what does the error mean in this case?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2018, 5:50pm UTC](https://discuss.elastic.co/t/tsl-ssl-failing-elastic-not-working/156299/14 "2018-12-11T17:50:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.