# Unable to find valid certification path to requested target
**URL:** https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [November 10, 2020, 12:25am UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829 "2020-11-10T00:25:18Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@drivera](https://discuss.elastic.co/u/drivera)
#### Post date: [November 10, 2020, 12:25am UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829/1 "2020-11-10T00:25:19Z")
Hello, I'm trying to authenticate users via AD with no success. Running ES 7.9.2. with TLS encryption in the cluster.
Below you can see the excerpt of the yml file where I'm setting up xpack security, and the error I am receiving when trying to login with an AD account in Kibana.
I should note, the key and certs in the xpack.security.transport.ssl are self signed by elastic. The rootca.pem file comes from my internal ca. Thanks for the help in advance.
```auto
# x pack settings
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/elastic-ca/host1.key
xpack.security.transport.ssl.certificate: /etc/elasticsearch/elastic-ca/host1.crt
xpack.security.transport.ssl.certificate_authorities: ["/etc/elasticsearch/elastic-ca/ca.crt"]
xpack:
security:
authc:
realms:
active_directory:
my_ad:
order: 0
domain_name: my.domain
url: ldaps://ad_server.domain.com:3269, ldaps://ad_server.domain.com:3269
ssl:
certificate_authorities: ["/etc/elasticsearch/elastic-ca/rootca.pem"]
```
Error message:
```auto
[2020-11-09T15:50:29,875][WARN][o.e.c.s.DiagnosticTrustManager] [host1.domain.com] failed to establish trust with server at [ad_server.domain.com]; the server provided a certificate with subject name [] and f
ingerprint [17d8390fdb9b1e22fb4a4427c4f0e865a0f232f2]; the certificate has subject alternative names [DNS:ad_server.domain.com]; the certificate is issued by [CN=Domain Enterprise Root,DC=empty,DC=local] but the server
did not provide a copy of the issuing certificate in the certificate chain; this ssl context ([xpack.security.authc.realms.active_directory.my_ad.ssl]) is not configured to trust that issuer
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 10, 2020, 1:10am UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829/2 "2020-11-10T01:10:08Z")
In the diagnostic message we have:
> the certificate is issued by [CN=Domain Enterprise Root,DC=empty,DC=local]
That is, your AD server has a certificate issued (signed) by `CN=Domain Enterprise Root,DC=empty,DC=local`
Is that the `/etc/elasticsearch/elastic-ca/rootca.pem` certificate? It doesn't appear to be (because it's not working).
If you run
```auto
openssl x509 -in /etc/elasticsearch/elastic-ca/rootca.pem -noout -subject -issuer -fingerprint
```
You can see the details of your Root CA.
---
### Author:  [@drivera](https://discuss.elastic.co/u/drivera)
#### Post date: [November 10, 2020, 5:53pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829/3 "2020-11-10T17:53:20Z")
Here is the output of the openssl command. in all cases, I'm replacing my actual domain name with the word domain. I see that in the error message CN=Domain Enterprise, but the output of opensll it states; CN=Domain Issuing CA
issuer= /CN=Domain Root CA
Not sure if there is a difference. Am I not using the right certificate?
```auto
root@red-inf-elkc-p1 ~]# openssl x509 -in /etc/elasticsearch/elastic-ca/rootca.pem -noout -subject -issuer -fingerprint
subject= /DC=com/DC=domain/CN=Domain Issuing CA
issuer= /CN=Domain Root CA
SHA1 Fingerprint=18:9D:7B:28:C0:73:3C:96:28:F2:FA:0A:87:4F:69:8C:2F:2A:A6:11
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 11, 2020, 12:43am UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829/4 "2020-11-11T00:43:25Z")
If the DNs of the certificates don't match, then it is almost certainly the wrong certificate.
Your best is to talk to the team that manages AD and/or your Certificate Issuing and find out what you're supposed to use.
It looks like you've been given the right CA _in general_, but it's not correct for that AD server.
---
### Author:  [@drivera](https://discuss.elastic.co/u/drivera)
#### Post date: [November 11, 2020, 10:12pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829/5 "2020-11-11T22:12:47Z")
Update: This issue was being caused by one of my nodes in the cluster not having the correct certificate in the authorities path. One stinking node was causing the issue.
```auto
certificate_authorities: ["/etc/elasticsearch/elastic-ca/certificate.pem"]
```
Tim V, thanks for your help .
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 9, 2020, 10:12pm UTC](https://discuss.elastic.co/t/unable-to-find-valid-certification-path-to-requested-target/254829/6 "2020-12-09T22:12:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.