# Upgrading to 8.15 got Bad certificate error

**URL:** <https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748>\
**Category:** Elasticsearch\
**Created:** [January 27, 2025, 9:06pm UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748 "2025-01-27T21:06:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Post date:** [January 27, 2025, 9:06pm UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748/1 "2025-01-27T21:06:57Z")

</div>

I am tring to upgrade Elasticsearch from 7.17 to 8.15. I've got a bad certificate error .

```auto
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

```

Here is my ssl setting in elasticsearch.yml:

```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/node1/node1.key
xpack.security.transport.ssl.certificate: /etc/elasticsearch/node1/node1.crt
xpack.security.transport.ssl.certificate_authorities: /etc/elasticsearch/ca/ca.crt
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.verification_mode: certificate
xpack.security.http.ssl.key: /etc/elasticsearch/node1/node1.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/node1/node1.crt
xpack.security.http.ssl.certificate_authorities: /etc/elasticsearch/ca/ca.crt

```

How should I change the certificate to match version 8.15?  
Thank you!

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [January 28, 2025, 3:25am UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748/2 "2025-01-28T03:25:41Z")

</div>

You need to give us a lot more information.

- What does your cluster look like?
  - How many nodes?
  - Do they all have the same config?

- How did you do the upgrade?
  - Did you change settings when you upgraded?
  - Did you create new certificates?

- What triggers the error?
  - Where are you seeing that error?
  - What is the rest of the log message?

---

<div class="post-metadata">

**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Post date:** [January 28, 2025, 4:13pm UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748/3 "2025-01-28T16:13:04Z")

</div>

I have two Elasticsearch nodes, with one server as filebeat, one server as logstash and another server as kibana.  
Two elasticsearch nodes are in the same config.  
I've upgraded the ELK system from 7.14 to 7.17  
Now I am upgrading the node1 elasticsearch to 8.15.  
I did not create any new certificates.  
When I restarted this node, it failed. I found this error in the log.  
Bad certificate is the only error for now.

---

<div class="post-metadata">

**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Post date:** [January 28, 2025, 4:16pm UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748/4 "2025-01-28T16:16:51Z")

</div>

The 8.15 elasticsearch requires the TSL configuration like this:

```auto
xpack.security.transport.ssl.enabled: true 
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

```

but I do not have the p12 key.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [January 29, 2025, 1:22pm UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748/5 "2025-01-29T13:22:04Z")

</div>

> [@rachelyang](#):
>
> The 8.15 elasticsearch requires the TSL configuration like this:

Did you have the same configuration in 7.14?

---

<div class="post-metadata">

**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Post date:** [January 29, 2025, 3:42pm UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748/6 "2025-01-29T15:42:16Z")

</div>

Yes, I use the same configuration as 7.14