# Unable to access https://localhost:9200, issue with Elastic User

**URL:** <https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 7, 2021, 6:38pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510 "2021-04-07T18:38:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bbruteforce](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bbruteforce/32/86738_2.png) [@Bbruteforce](https://discuss.elastic.co/u/Bbruteforce)\
**Post date:** [April 7, 2021, 6:38pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510/1 "2021-04-07T18:38:23Z")

</div>

Hello Team,  
I am trying to send data from Wazuh Manager to Elasticsearch via Filebeat over port 9200. In the "Discover" tab of Kibana i see no data , even though the agent seems to sending data properly to manager  
I see the below error , even when the password is correct .when i try to use the command  
curl -u elastic:password -k [https://10.x.x.x:9200/\_security/\_authenticate?pretty](https://10.x.x.x:9200/_security/_authenticate?pretty)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4a81fb9855400f00708c1b89b25e902a31b20a4d.png)

and when i try to change the password , i see the below error.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43678200544d7f9cbbacc6444e6b13ab9e770046.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 7, 2021, 9:12pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510/2 "2021-04-07T21:12:57Z")

</div>

Welcome to our community! 😃  
Please don't post pictures of text, they are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [April 8, 2021, 1:52am UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510/3 "2021-04-08T01:52:52Z")

</div>

What do the [ES logs](https://www.elastic.co/guide/en/elasticsearch/reference/current/logging.html) say?

---

<div class="post-metadata">

**Author:** ![Bbruteforce](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bbruteforce/32/86738_2.png) [@Bbruteforce](https://discuss.elastic.co/u/Bbruteforce)\
**Post date:** [April 8, 2021, 2:39pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510/4 "2021-04-08T14:39:51Z")

</div>

Hello @TimV ,  
I see that there are files is van/log/elasticsearch.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5f4947dd21b0343b22b19d966752242d83402f74.png)  
Below are the contents of elasticsearch.log

```auto
    [2021-04-08T00:00:03,542][INFO][o.e.c.m.MetadataCreateIndexService] [Elastic Node-1] [wazuh-monitoring-3.x-2021.04.08] creating index, cause [api], templates [wazuh-agent], shards [2]/[0]
[2021-04-08T00:00:03,803][INFO][o.e.c.r.a.AllocationService] [Elastic Node-1] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[wazuh-monitoring-3.x-2021.04.08][0]]]).
[2021-04-08T00:00:04,007][INFO][o.e.c.m.MetadataMappingService] [Elastic Node-1] [wazuh-monitoring-3.x-2021.04.08/goZP3Gk8RfmukzJsk4ISTQ] update_mapping [_doc]
[2021-04-08T00:00:05,533][WARN][o.e.h.AbstractHttpServerTransport] [Elastic Node-1] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/10.40.60.220:9200, remoteAddress=/10.40.48.35:39974}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~[netty-codec-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-codec-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:615) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:578) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) [netty-common-4.1.49.Final.jar:4.1.49.Final]
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.49.Final.jar:4.1.49.Final]
        at java.lang.Thread.run(Thread.java:832) [?:?]
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
        at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:356) ~[?:?]
        at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) ~[?:?]
        at sun.security.ssl.TransportContext.dispatch(TransportContext.java:202) ~[?:?]
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:171) ~[?:?]
        at sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:736) ~[?:?]
        at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:691) ~[?:?]
        at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:506) ~[?:?]
        at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:482) ~[?:?]
        at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:637) ~[?:?]

```

---

<div class="post-metadata">

**Author:** ![Bbruteforce](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bbruteforce/32/86738_2.png) [@Bbruteforce](https://discuss.elastic.co/u/Bbruteforce)\
**Post date:** [April 8, 2021, 2:41pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510/5 "2021-04-08T14:41:16Z")

</div>

Hello @warkolm ,

Sorry i was new to the community so didnt know that .

---

<div class="post-metadata">

**Author:** ![Bbruteforce](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bbruteforce/32/86738_2.png) [@Bbruteforce](https://discuss.elastic.co/u/Bbruteforce)\
**Post date:** [April 8, 2021, 4:19pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510/6 "2021-04-08T16:19:38Z")

</div>

@TimV ,  
And also when i try to `curl -u username:password -k https://elasticip:9200` using user "elastic" it throws the following error and when i use a different user i get a response  
`{"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}`  
b

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2021, 4:20pm UTC](https://discuss.elastic.co/t/unable-to-access-https-localhost-9200-issue-with-elastic-user/269510/7 "2021-05-06T16:20:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.