# Workplace\_search\_ca **URL:** \ **Category:** Elastic Search\ **Tags:** elastic-workplace-search\ **Created:** [July 27, 2022, 12:36pm UTC](https://discuss.elastic.co/t/workplace-search-ca/310747 "2022-07-27T12:36:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![shamorai](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@shamorai](https://discuss.elastic.co/u/shamorai)\ **Post date:** [July 27, 2022, 12:36pm UTC](https://discuss.elastic.co/t/workplace-search-ca/310747/1 "2022-07-27T12:36:40Z")
When tying to add confluence server/jira server I keep getting ssl verification error, problem is I can't find any setting in the documentation for a truststore, or certificate\_authorities. I have looked at: [Configuration | Elastic Enterprise Search documentation [8.4] | Elastic](https://www.elastic.co/guide/en/enterprise-search/current/configuration.html) And looked for maybe a JVM\_OPTS parameter that I could use but couldn't figure out which parameters can be used. ---
**Author:** ![Sean\_Story](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sean_story/32/69987_2.png) [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Post date:** [July 27, 2022, 8:08pm UTC](https://discuss.elastic.co/t/workplace-search-ca/310747/2 "2022-07-27T20:08:59Z")
Hi @shamorai The best solution is to have your certs signed by an official certificate authority. However, if that's not possible at this time, you can configure your OpenSSL environment to find a non-default trust store or certificate. For example, I've used: ```auto export SSL_CERT_FILE=/Users/seanstory/Desktop/cert.pem ``` before in order to work around a self-signed certificate for a development content source. See: [/docs/man1.1.1/man3/SSL\_CTX\_set\_default\_verify\_paths.html](https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_default_verify_paths.html) Hopefully this helps! ---
**Author:** ![shamorai](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@shamorai](https://discuss.elastic.co/u/shamorai)\ **Post date:** [July 27, 2022, 9:29pm UTC](https://discuss.elastic.co/t/workplace-search-ca/310747/3 "2022-07-27T21:29:17Z")
Running enterprise-search v8.2.3 My certificate is signed by our "official ca" In our intranet. I can't seem to find anyway to add a ca certificate. Is the SSL\_CERT\_FILE env variable mentioned in any of the Documentation for enterprise-search, or that the jvm uses the default openssl cacerts? after setting the env variable, `curl https://jira-test.intranet:8443` works with no errors. But when trying to connect to jira server I'm still getting: ```auto Exception: Faraday::SSLError: certificate verify failed from uri:classloader:/META_INF/jruby.home/lib/ruby/stdlib/net/http.rb:934:in 'do_start' ... ... from /usr/share/enterprise-search/lib/war/vendor/fishwife-servlet/lib/fishwife/rack_servlet.rb:74:in 'service' ``` ---
**Author:** ![Sean\_Story](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sean_story/32/69987_2.png) [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Post date:** [July 28, 2022, 6:41pm UTC](https://discuss.elastic.co/t/workplace-search-ca/310747/4 "2022-07-28T18:41:58Z")
Hi @shamorai > But when trying to connect to jira server I'm still getting: `Exception: Faraday::SSLError: certificate verify failed` Have you added your root certificate into the JVM keystore? See guides like: [How to import a CA root certificate into the JVM trust store | Connect2id](https://connect2id.com/blog/importing-ca-root-cert-into-jvm-trust-store) > Is the SSL\_CERT\_FILE env variable mentioned in any of the Documentation for enterprise-search, or that the jvm uses the default openssl cacerts? I don't believe this is in our documentation, no. I'll flag this as an area where we can improve our SSL guide. I expect that most customers are using root certificates that are signed by an external CA for their content sources, and therefore do not run into this issue - it's more common to use self-signed certs or internal CA certs for non-user-facing (or few user facing) services like Elasticsearch and Enterprise Search. But your use case is a valid one. ---
**Author:** ![shamorai](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@shamorai](https://discuss.elastic.co/u/shamorai)\ **Post date:** [July 28, 2022, 9:15pm UTC](https://discuss.elastic.co/t/workplace-search-ca/310747/5 "2022-07-28T21:15:49Z")
I have tried adding **javax.net.ssl.trustStore** , **javax.net.ssl.trustStorePassword** and **javax.net.ssl.trustStoreType** to the JAVA\_OPTS env variable but had no luck. I will try importing my cacerts to the default truststore location and give an update > [@Sean\_Story](#): > > I expect that most customers are using root certificates that are signed by an external CA for their content sources, and therefore do not run into this issue - it's more common to use self-signed certs or internal CA certs for non-user-facing (or few user facing) services like Elasticsearch and Enterprise Search. I thought it's common for confluence server and jira server which are on prem services to have certificates which are signed by the intranet's ca. ---
**Author:** ![shamorai](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@shamorai](https://discuss.elastic.co/u/shamorai)\ **Post date:** [July 31, 2022, 5:59pm UTC](https://discuss.elastic.co/t/workplace-search-ca/310747/6 "2022-07-31T17:59:38Z")
Updating, on the topic. I have not been able to find a way to import cacerts as of yet. However I was able to disable certificate verification entirely by editing /usr/share/enterprise-search/lib/war/gems/gems/faraday-net\_http-1.0.1/lib/faraday/adapter/net\_http.rb directly. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 31, 2022, 2:48am UTC](https://discuss.elastic.co/t/workplace-search-ca/310747/7 "2022-10-31T02:48:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.