# Webhook https , ignoring verification of certificate **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [July 20, 2015, 6:35am UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874 "2015-07-20T06:35:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![micjaesc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micjaesc/32/3785_2.png) [@micjaesc](https://discuss.elastic.co/u/micjaesc)\ **Post date:** [July 20, 2015, 6:35am UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/1 "2015-07-20T06:35:29Z")
Hi, Is there any way to skip SSL validation when sending notification? Presently I have "actions": [ { "id": "SLACK\_notify", "type": "webhook", "status": "failure", "reason": "SSLHandshakeException[java.security.cert.CertificateException: No name matching [hooks.slack.com](http://hooks.slack.com) found]; nested: CertificateException[No name matching [hooks.slack.com](http://hooks.slack.com) found]; " } ] It would be great to have similar options as curl has, means: "If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option." I have SSL proxy, it will be difficult to "fix" infrastructure. I don't need verification of certificate. Best Regards Michal ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 20, 2015, 6:37am UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/2 "2015-07-20T06:37:06Z")
If you aren't doing validation why even bother with SSL? ---
**Author:** ![micjaesc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micjaesc/32/3785_2.png) [@micjaesc](https://discuss.elastic.co/u/micjaesc)\ **Post date:** [July 20, 2015, 8:07am UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/3 "2015-07-20T08:07:12Z")
Not sure if understand correctly Your question. I'm forced to use https (the only way provided by slack) "webhook" : { "method" : "POST", "scheme" : "https", "port" : 443, "host" : "[hooks.slack.com](http://hooks.slack.com)") Unfortunately I have some wrong SSL proxy (in the middle), which causes SSLHandshakeException on watcher side. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 23, 2015, 12:07am UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/4 "2015-07-23T00:07:56Z")
Using SSL and then turning off validation makes SSL useless. You might as well just run HTTP. ---
**Author:** ![pgs](https://avatars.discourse-cdn.com/v4/letter/p/f14d63/32.png) [@pgs](https://discuss.elastic.co/u/pgs)\ **Post date:** [January 13, 2016, 6:11pm UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/5 "2016-01-13T18:11:48Z")
I don't know how to ignore the certificate but you can add your CA cert to be trusted: 1. Add this line to /etc/default/elasticsearch `ES_JAVA_OPTS=-Djavax.net.ssl.trustStore=/etc/pki/java/cacerts` 2.) Add your CA certificate to the keystore: `keytool -import -trustcacerts -alias XYZ -file /tmp/cert.pem -keystore /etc/pki/java/cacerts` 3.) Restart ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [January 14, 2016, 8:50am UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/6 "2016-01-14T08:50:50Z")
Hey, using the `watcher.http.ssl.keystore.{path,password,key_password,algorithm}` settings, one can also use a dedicated keystore for the http input/webhook action, which is also used as truststore, unless you are using shield, which uses it's own. --Alex ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/7 "2017-07-06T13:47:23Z")
---
**Author:** ![Mike.Barretta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike.barretta/32/16688_2.png) [@Mike.Barretta](https://discuss.elastic.co/u/Mike.Barretta)\ **Post date:** [November 27, 2017, 11:27pm UTC](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/8 "2017-11-27T23:27:25Z")
For posterity (and v5-6), you can disable cert verification in watcher via a setting: [Watcher settings in Elasticsearch | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/notification-settings.html#ssl-notification-settings) > `xpack.http.ssl.verification_mode` > Controls the verification of certificates. Valid values are `none`, `certificate`, and `full`. Defaults to the value of xpack.ssl.verification\_mode.