Upgrading to 8.15 got Bad certificate error

Elastic Stack Elasticsearch
1

I am tring to upgrade Elasticsearch from 7.17 to 8.15. I've got a bad certificate error .

Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

Here is my ssl setting in elasticsearch.yml:

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/node1/node1.key
xpack.security.transport.ssl.certificate: /etc/elasticsearch/node1/node1.crt
xpack.security.transport.ssl.certificate_authorities: /etc/elasticsearch/ca/ca.crt
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.verification_mode: certificate
xpack.security.http.ssl.key: /etc/elasticsearch/node1/node1.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/node1/node1.crt
xpack.security.http.ssl.certificate_authorities: /etc/elasticsearch/ca/ca.crt

How should I change the certificate to match version 8.15?
Thank you!

2

You need to give us a lot more information.

  • What does your cluster look like?
    • How many nodes?
    • Do they all have the same config?
  • How did you do the upgrade?
    • Did you change settings when you upgraded?
    • Did you create new certificates?
  • What triggers the error?
    • Where are you seeing that error?
    • What is the rest of the log message?
3

I have two Elasticsearch nodes, with one server as filebeat, one server as logstash and another server as kibana.
Two elasticsearch nodes are in the same config.
I've upgraded the ELK system from 7.14 to 7.17
Now I am upgrading the node1 elasticsearch to 8.15.
I did not create any new certificates.
When I restarted this node, it failed. I found this error in the log.
Bad certificate is the only error for now.

4

The 8.15 elasticsearch requires the TSL configuration like this:

xpack.security.transport.ssl.enabled: true 
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

but I do not have the p12 key.

5

Did you have the same configuration in 7.14?

6

Yes, I use the same configuration as 7.14