# Watcher Http Input - PKIX path building failed **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-monitoring, elastic-stack-alerting\ **Created:** [November 29, 2023, 10:44pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279 "2023-11-29T22:44:40Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Rossana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossana/32/94216_2.png) [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Post date:** [November 29, 2023, 10:44pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/1 "2023-11-29T22:44:40Z")
Hi, I create a watcher to monitoring de HEALTH of the Cluster. ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/6/8691e390204a998b5d9efd7b8d9b02684e20d6f2.png) I did get this error on the watcher response: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e9c5b23787b5f2203ca668070b9d34d01b5d19d9.jpeg) I also check my kibana configuration and I have TLS config : ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/10692522f42d5b316230261ea9f1e50ccf5a4360.png) I dont know why this error happend! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 29, 2023, 11:05pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/2 "2023-11-29T23:05:21Z")
Hi @Rossana I think it is because the "Watcher" does not know it is hitting HTTPS of the Elastic Cluster (to the watcher it is just ANY http endpoint), so it does not reference the CA that is in the kibana.yml which is only for the Kibana -\> Elasticsearch Connection not any connection in a watcher. And just to be clear watcher actually executes in Elasticsearch... not Kibana Depending on the version of Elastic, you could just use heartbeat or synthetics and the uptime app to do the same thing... But curious... If the cluster is down / not responsive, the watcher will not run anyways... are you monitoring from a different cluster? What exactly are you trying to accomplish? ---
**Author:** ![Rossana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossana/32/94216_2.png) [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Post date:** [November 30, 2023, 3:21pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/3 "2023-11-30T15:21:49Z")
Hi, I only want to monitor with watchers the status (to know if some shards are not allocated), the number of shards, the size of the shards... only those things at the moment. The watcher is from the same cluster. Do you know What I need to do in order to make it work? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 30, 2023, 4:05pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/4 "2023-11-30T16:05:30Z")
What version are you on? The standard approach would be to use Some form of Stack Monitoring and Alerting. ---
**Author:** ![Rossana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossana/32/94216_2.png) [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Post date:** [November 30, 2023, 4:21pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/5 "2023-11-30T16:21:08Z")
Versión: 7.17 In this link it says that is possible > **[Watcher HTTP input | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/input-http.html)** ---
**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\ **Post date:** [November 30, 2023, 4:35pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/6 "2023-11-30T16:35:29Z")
Hi Rossana, To enable secure HTTPS connections between Watcher, Kibana reporting, and Elasticsearch using a self-signed certificate in Kibana, include the CA certificate in Elasticsearch. Either add the CA certificate through xpack.http.ssl.certificate\_authorities in elasticsearch.yml, or ensure ca.crt for the Kibana certificate is in /etc/elasticsearch/certs/watcher-truststore.jks. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 30, 2023, 4:54pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/7 "2023-11-30T16:54:28Z")
Hi @Rossana so yes as @yago82 Said, please look at these settings. You will need to set these in your elasticsearch.yml > **[Watcher settings in Elasticsearch | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/notification-settings.html#ssl-notification-settings)** This is not as secure... `xpack.http.ssl.verification_mode: none` or set the path to the CA... `xpack.http.ssl.certificate_authorities: ["/path/to/http_ca.crt"]` ---
**Author:** ![Rossana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossana/32/94216_2.png) [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Post date:** [November 30, 2023, 5:09pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/8 "2023-11-30T17:09:53Z")
Ok. thanks to both. @yago82 @stephenb This is the elasticseach.yml of one of my nodes: ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7f8550141e098a60afa27bba51bc5e60caaef86f.png) > Either add the CA certificate through xpack.http.ssl.certificate\_authorities in elasticsearch.yml, or ensure ca.crt for the Kibana certificate is in /etc/elasticsearch/certs/watcher-truststore.jks. which certificate do I must aggregate? I also have an ssl.keystore.path configured already. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 30, 2023, 5:16pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/9 "2023-11-30T17:16:56Z")
> [@Rossana](#): > > which certificate do I must aggregate? I also have an ssl.keystore.path configured already. You need the CA for the http endpoint, that you used to create the http.p12, you used a CA to create that... you need to find that, and put that in the `xpack.http.ssl.certificate_authorities: ["/path/to/http_ca.crt"]` BTW Screenshots of text is discouraged, hard to read, can not be searched, debug etc... ---
**Author:** ![Rossana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossana/32/94216_2.png) [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Post date:** [November 30, 2023, 5:24pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/10 "2023-11-30T17:24:03Z")
THANKS! I dont have access to copy the text from VPN (security policies). There is no problem if my parameters are xpack.security.http.ssl? with security word? Because you used xpack.http.ssl.certificate\_authorities. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 30, 2023, 6:06pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/11 "2023-11-30T18:06:25Z")
> [@Rossana](#): > > I dont have access to copy the text from VPN (security policies). Understood... > [@Rossana](#): > > There is no problem if my parameters are xpack.security.http.ssl? with security word? > Because you used xpack.http.ssl.certificate\_authorities. Apologies I do not understand you need to set the settings... I do not know what security word you are referring too... You need to do 1 of the 2 settings I showed above ---
**Author:** ![Rossana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossana/32/94216_2.png) [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Post date:** [November 30, 2023, 6:12pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/12 "2023-11-30T18:12:06Z")
I mean: I must add to elasticsearch.yml xpack.http.ssl.certificate\_authorities: ["/path/to/http\_ca.crt"] or xpack. **security**.http.ssl.certificate\_authorities: ["/path/to/http\_ca.crt"] ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 30, 2023, 6:19pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/13 "2023-11-30T18:19:36Z")
Please look at the document I provided ... yes there are many similar settings... From the docs [HERE](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/notification-settings.html#ssl-notification-settings) that refer to Watcher You can see the correct settings.... > `xpack.http.ssl.certificate_authorities` > > ([Static](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/settings.html#static-cluster-setting)) List of paths to PEM encoded certificate files that should be trusted. > > This setting and `ssl.truststore.path` cannot be used at the same time. ---
**Author:** ![Rossana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rossana/32/94216_2.png) [@Rossana](https://discuss.elastic.co/u/Rossana)\ **Post date:** [November 30, 2023, 7:37pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/14 "2023-11-30T19:37:42Z")
I understand, but in my case I already have a truststore configured here. ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f0212617d330efda6e23d272abc07183052045f2.png) | ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 30, 2023, 7:52pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/15 "2023-11-30T19:52:34Z")
Yes but that is **not** the path the watcher component will access... And what you circled above is the transport endpoint ... **nothing to do with watcher http input**.. nothing at all... and **nothing** to do with the http endpoint which is the bottom line in your picture... None of those settings in your screen shot have anything to do with the watcher http input setting... I think we have provided the correct settings... If you get it to work otherwise, please let us know... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 28, 2023, 7:52pm UTC](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/16 "2023-12-28T19:52:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.