# Where do we define the password for cert generated using elastic certutil in yml file?

**URL:** <https://discuss.elastic.co/t/where-do-we-define-the-password-for-cert-generated-using-elastic-certutil-in-yml-file/278448>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [July 12, 2021, 5:34pm UTC](https://discuss.elastic.co/t/where-do-we-define-the-password-for-cert-generated-using-elastic-certutil-in-yml-file/278448 "2021-07-12T17:34:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![devashishsingh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devashishsingh/32/89628_2.png) [@devashishsingh](https://discuss.elastic.co/u/devashishsingh)\
**Post date:** [July 12, 2021, 5:34pm UTC](https://discuss.elastic.co/t/where-do-we-define-the-password-for-cert-generated-using-elastic-certutil-in-yml-file/278448/1 "2021-07-12T17:34:07Z")

</div>

Hello,

In order to enable SSL security, I did follow steps and generated the certificate first. While generating it asked for a password(to create one for the cert protection)

_Please enter the desired output file [elastic-certificates.p12]: /etc/elasticsearch/elastic-certificates.p12_  
Enter password for elastic-certificates.p12:

_Certificates written to /etc/elasticsearch/elastic-certificates.p12_

After that when I went in and make changes to the yml file, it only gives you the option to define the path and elastic service could not be started with a clear message:

failed to initialize SSL TrustManager - not permitted to read truststore file [/etc/elasticsearch/elastic-certifica  
tes.p12

which I believe is only because I have not mentioned password anywhere. Any line that I could add or may be use keystore util to provide password for the cert?

Thank you so much

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [July 12, 2021, 11:55pm UTC](https://discuss.elastic.co/t/where-do-we-define-the-password-for-cert-generated-using-elastic-certutil-in-yml-file/278448/2 "2021-07-12T23:55:18Z")

</div>

If the error is along the line of `not permitted to read ... file`, it is a file permission issue, not password issue. In this case, you need fix the file permission so the elasticsearch process can read it. You can find details in this [post](https://discuss.elastic.co/t/error-when-trying-to-setup-basic-security-for-the-elastic-stack/278473/2).

After fixing the file permission issue, you may run into the actual password issue since you haven't specified it anywhere. You can add that to the elasticsearch keystore with the command:

```auto
./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
./bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

```

You can also check the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/security-basic-setup.html#encrypt-internode-communication) for details.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2021, 11:56pm UTC](https://discuss.elastic.co/t/where-do-we-define-the-password-for-cert-generated-using-elastic-certutil-in-yml-file/278448/3 "2021-08-09T23:56:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.