# Unable to start elasticsearch after encryption? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 1, 2015, 7:51am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690 "2015-07-01T07:51:16Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 1, 2015, 7:51am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/1 "2015-07-01T07:51:16Z")
For encryption i followed each and every step. I added the lines into .yml file as show in [https://www.elastic.co/guide/en/shield/current/\_configure\_the\_keystores\_and\_enable\_ssl.html](https://www.elastic.co/guide/en/shield/current/_configure_the_keystores_and_enable_ssl.html) after adding.. im unable to start elasticsearch? please help me? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 1, 2015, 10:15am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/2 "2015-07-01T10:15:27Z")
Hi, You will need to provide us with more information in order to help you. What happens when you start elasticsearch? what is in your elasticsearch.yml? any exceptions in the log? -Jay ---
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 1, 2015, 11:52am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/3 "2015-07-01T11:52:20Z")
I added these lines in .yml file. ``` shield.ssl.keystore.path: /home/es/config/node01.jks shield.ssl.keystore.password: myPass shield.ssl.truststore.path: /home/es/config/truststore.jks shield.ssl.truststore.password: myPass shield.transport.ssl: true shield.http.ssl: true discovery.zen.ping.multicast.enabled: false discovery.zen.ping.unicast.hosts: ["node01:9300", "node02:9301"] ``` After adding these to .yml file... elasticsearch service is not starting. Its not showing any error. But, its not starting. ? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 1, 2015, 12:54pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/4 "2015-07-01T12:54:28Z")
Are you starting via a init/service script or using "bin/elasticsearch"? Are the keystore and truststore files readable permission wise by the user running elasticsearch? Nothing is being written in the logs when starting up? If not, the best way to try to figure out what is wrong is to comment out the configuration changes. I'd recommend first commenting out the newly added settings except for the discovery ones. Start elasticsearch and verify it is working. Then try adding in the shield.ssl.keystore settings. Verify that works and keep going. ---
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 1, 2015, 2:01pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/6 "2015-07-01T14:01:43Z")
I commented everything except discovery... now its working fine. If i add those shield lines...its not starting.. why this is happening... ? please help me.. Thanks in advance... ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 1, 2015, 2:34pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/7 "2015-07-01T14:34:16Z")
Can you provide answers to all of these questions: 1. Anything in your log files? 2. Did you check the file permissions? 3. Are the passwords/locations correct? ---
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 1, 2015, 3:33pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/9 "2015-07-01T15:33:13Z")
Hey now its working... if im commenting out this line ``` shield.http.ssl: true ``` If im enabling it also..elasticsearch is started... but, if im accessing localhost:9200 ... im not getting the response. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 1, 2015, 3:59pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/10 "2015-07-01T15:59:32Z")
Did you add `https` to the URL? So `https://localhost:9200`. Your browser may give certificate warnings ---
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 1, 2015, 4:11pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/11 "2015-07-01T16:11:49Z")
Yes.. I got now.. Thanq very much for ur support @jaymode 😊 ---
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 2, 2015, 6:02am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/12 "2015-07-02T06:02:18Z")
Now im getting issue regarding kibana... I pointed elasticsearch url to `https://localhost:9200` in kibana.yml ... Now kibana is not starting.?? It showing me some errors like: ``` "No living connections","node_env":"production" Unable to connect to elasticsearch at https://localhost:9200. Retrying in 2.5 seconds.","node_env":"production" "error","node_env":"production","error":"Request error, retrying -- DEPTH_ZERO_SELF_SIGNED_CERT"} ``` ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 2, 2015, 10:21am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/13 "2015-07-02T10:21:31Z")
Did you configure Kibana for SSL, specifically the `ca` parameter? [https://www.elastic.co/guide/en/kibana/current/production.html#enabling-ssl](https://www.elastic.co/guide/en/kibana/current/production.html#enabling-ssl) ---
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 2, 2015, 10:25am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/14 "2015-07-02T10:25:34Z")
yes i have given ... eventhough im not able to start... Its giving me main error ``` "error","node_env":"production","error":"Request error, retrying -- DEPTH_ZERO_SELF_SIGNED_CERT"} ``` ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 2, 2015, 10:55am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/15 "2015-07-02T10:55:58Z")
Is the issuer of your certificate the same as the subject? ---
**Author:** ![Akhilesh\_Anb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh_anb/32/4343_2.png) [@Akhilesh\_Anb](https://discuss.elastic.co/u/Akhilesh_Anb)\ **Post date:** [July 3, 2015, 7:07am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/16 "2015-07-03T07:07:30Z")
Sry i didnt get you Jaymode... ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [July 7, 2015, 11:06am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/17 "2015-07-07T11:06:42Z")
The certificate that you've created for your elasticsearch instance, has two fields an issuer and a owner. The issuer is the CA that has signed the certificate and the owner/subject the entity that the certificate represents. Executing `keytool -list -v -keystore node01.jks` should provide this information. My example shows the following: ``` Alias name: node01 Creation date: Jun 3, 2015 Entry type: PrivateKeyEntry Certificate chain length: 2 Certificate[1]: Owner: CN=Test Node Issuer: C=NL, ST=Amsterdam, L=Amsterdam, EMAILADDRESS=cacerttest@YOUR.COMPANY.TLD, O=Elasticsearch Test Org ``` My question to you is whether you have the same owner and issuer in your certificate? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-encryption/24690/18 "2017-07-06T13:48:58Z")