# Invalid certificates after offline sgtool generation **URL:** \ **Category:** Search Guard\ **Created:** [December 18, 2018, 2:44pm UTC](https://forum.search-guard.com/t/invalid-certificates-after-offline-sgtool-generation/1253 "2018-12-18T14:44:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Jan\_Pesek](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@Jan\_Pesek](https://forum.search-guard.com/u/Jan_Pesek)\ **Post date:** [December 18, 2018, 2:44pm UTC](https://forum.search-guard.com/t/invalid-certificates-after-offline-sgtool-generation/1253/1 "2018-12-18T14:44:30Z")
Hi, I am using elasticsearch 6.5.3 with searchguard 6-6.5.3-23.2. (jre1.8.0\_181, CentOS Linux 7). I used sgtool to generate node and CA certificate, but elastic won’t start due to: SSL Problem General OpenSslEngine problem javax.net.ssl.SSLHandshakeException: General OpenSslEngine problem … Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target `` In older 6.3.2 version were this steps and configurations ok. Also I put _“netty-tcnative-openssl-1.1.0j-static-2.0.15.Final-fedora-linux-x86\_64-plugins-search-guard-6”_ to _plugins/search-guard-6/_ certs\_def.yml for sgtool: ca: root: dn: CN=root.ca keysize: 4096 pkPassword: auto validityDays: 3650 file: root-ca nodes: - name: elasticsearchNode dn: CN=elasticsearch.node ip: ip\_addr clients: - name: admin dn: CN=admin admin: true `` elasticsearch.yml: cluster.name: elastic-cluster node.name: elasticsearchNode path.data: /elastic/data/elasticsearch path.logs: /elastic/log/elasticsearch bootstrap.memory\_lock: true network.host: ip\_addr http.port: 9200 searchguard.roles\_mapping\_resolution: BACKENDROLES\_ONLY searchguard.ssl.transport.pemcert\_filepath: certs/elasticsearchNode.pem searchguard.ssl.transport.pemkey\_filepath: certs/elasticsearchNode.key searchguard.ssl.transport.pemtrustedcas\_filepath: certs/root-ca.pem searchguard.ssl.transport.enforce\_hostname\_verification: false searchguard.ssl.transport.resolve\_hostname: false searchguard.ssl.http.enabled: true searchguard.ssl.http.pemcert\_filepath: certs/elasticsearchNode.pem searchguard.ssl.http.pemkey\_filepath: certs/elasticsearchNode.key searchguard.ssl.http.pemtrustedcas\_filepath: certs/root-ca.pem searchguard.allow\_unsafe\_democertificates: false searchguard.allow\_default\_init\_sgindex: false searchguard.authcz.admin\_dn: - CN=admin searchguard.ssl.http.enabled\_protocols: - “TLSv1.2” searchguard.ssl.transport.enabled\_protocols: - “TLSv1.2” searchguard.enterprise\_modules\_enabled: false `` Thanks in advance. ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [December 18, 2018, 7:22pm UTC](https://forum.search-guard.com/t/invalid-certificates-after-offline-sgtool-generation/1253/2 "2018-12-18T19:22:54Z")
Which version of the offline tls tool did you use? > **···** > > > Am 18.12.2018 um 15:44 schrieb Jan Pešek \: > > > > Hi, > > I am using elasticsearch 6.5.3 with searchguard 6-6.5.3-23.2. (jre1.8.0\_181, CentOS Linux 7). > > > > I used sgtool to generate node and CA certificate, but elastic won't start due to: > > > > SSL Problem General OpenSslEngine problem javax.net.ssl.SSLHandshakeException: General OpenSslEngine problem > > ... > > Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target > > > > In older 6.3.2 version were this steps and configurations ok. Also I put "netty-tcnative-openssl-1.1.0j-static-2.0.15.Final-fedora-linux-x86\_64-plugins-search-guard-6" to plugins/search-guard-6/ > > > > certs\_def.yml for sgtool: > > > > ca: > >   root: > >     dn: CN=root.ca > >     keysize: 4096 > >     pkPassword: auto > >     validityDays: 3650 > >     file: root-ca > > nodes: > >   - name: elasticsearchNode > >     dn: CN=elasticsearch.node > >     ip: ip\_addr > > clients: > >   - name: admin > >     dn: CN=admin > >     admin: true > > > > elasticsearch.yml: > > > > cluster.name: elastic-cluster > > node.name: elasticsearchNode > > path.data: /elastic/data/elasticsearch > > path.logs: /elastic/log/elasticsearch > > bootstrap.memory\_lock: true > > network.host: ip\_addr > > http.port: 9200 > > > > searchguard.roles\_mapping\_resolution: BACKENDROLES\_ONLY > > > > searchguard.ssl.transport.pemcert\_filepath: certs/elasticsearchNode.pem > > searchguard.ssl.transport.pemkey\_filepath: certs/elasticsearchNode.key > > searchguard.ssl.transport.pemtrustedcas\_filepath: certs/root-ca.pem > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > searchguard.ssl.transport.resolve\_hostname: false > > searchguard.ssl.http.enabled: true > > searchguard.ssl.http.pemcert\_filepath: certs/elasticsearchNode.pem > > searchguard.ssl.http.pemkey\_filepath: certs/elasticsearchNode.key > > searchguard.ssl.http.pemtrustedcas\_filepath: certs/root-ca.pem > > searchguard.allow\_unsafe\_democertificates: false > > searchguard.allow\_default\_init\_sgindex: false > > searchguard.authcz.admin\_dn: > >   - CN=admin > > > > searchguard.ssl.http.enabled\_protocols: > >   - "TLSv1.2" > > searchguard.ssl.transport.enabled\_protocols: > >   - "TLSv1.2" > > > > searchguard.enterprise\_modules\_enabled: false > > > > Thanks in advance. > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/70be8831-f7f5-402b-a745-d62f2e4ade96%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/70be8831-f7f5-402b-a745-d62f2e4ade96%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Jan\_Pesek](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@Jan\_Pesek](https://forum.search-guard.com/u/Jan_Pesek)\ **Post date:** [December 19, 2018, 6:40pm UTC](https://forum.search-guard.com/t/invalid-certificates-after-offline-sgtool-generation/1253/3 "2018-12-19T18:40:52Z")
I’m using latest version search-guard-tlstool-1.5 ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [December 19, 2018, 10:51pm UTC](https://forum.search-guard.com/t/invalid-certificates-after-offline-sgtool-generation/1253/4 "2018-12-19T22:51:20Z")
That's pretty strange. Can you post a more complete log file (from where the node starts) until the error happens with full stack trace included? Please also try removing the tcnative jars from all nodes (and start them again) to so that we can see if this is a OpenSSL related problem or a general SSL problem. > **···** > > > Am 19.12.2018 um 19:40 schrieb emisar \: > > > > I'm using latest version search-guard-tlstool-1.5 > > > > Dne úterý 18. prosince 2018 20:22:58 UTC+1 Search Guard napsal(a): > > Which version of the offline tls tool did you use? > > > > \> > > \> Hi, > > \> I am using elasticsearch 6.5.3 with searchguard 6-6.5.3-23.2. (jre1.8.0\_181, CentOS Linux 7). > > \> > > \> I used sgtool to generate node and CA certificate, but elastic won't start due to: > > \> > > \> SSL Problem General OpenSslEngine problem javax.net.ssl.SSLHandshakeException: General OpenSslEngine problem > > \> ... > > \> Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target > > \> > > \> In older 6.3.2 version were this steps and configurations ok. Also I put "netty-tcnative-openssl-1.1.0j-static-2.0.15.Final-fedora-linux-x86\_64-plugins-search-guard-6" to plugins/search-guard-6/ > > \> > > \> certs\_def.yml for sgtool: > > \> > > \> ca: > > \> root: > > \> dn: CN=root.ca > > \> keysize: 4096 > > \> pkPassword: auto > > \> validityDays: 3650 > > \> file: root-ca > > \> nodes: > > \> - name: elasticsearchNode > > \> dn: CN=elasticsearch.node > > \> ip: ip\_addr > > \> clients: > > \> - name: admin > > \> dn: CN=admin > > \> admin: true > > \> > > \> elasticsearch.yml: > > \> > > \> cluster.name: elastic-cluster > > \> node.name: elasticsearchNode > > \> path.data: /elastic/data/elasticsearch > > \> path.logs: /elastic/log/elasticsearch > > \> bootstrap.memory\_lock: true > > \> network.host: ip\_addr > > \> http.port: 9200 > > \> > > \> searchguard.roles\_mapping\_resolution: BACKENDROLES\_ONLY > > \> > > \> searchguard.ssl.transport.pemcert\_filepath: certs/elasticsearchNode.pem > > \> searchguard.ssl.transport.pemkey\_filepath: certs/elasticsearchNode.key > > \> searchguard.ssl.transport.pemtrustedcas\_filepath: certs/root-ca.pem > > \> searchguard.ssl.transport.enforce\_hostname\_verification: false > > \> searchguard.ssl.transport.resolve\_hostname: false > > \> searchguard.ssl.http.enabled: true > > \> searchguard.ssl.http.pemcert\_filepath: certs/elasticsearchNode.pem > > \> searchguard.ssl.http.pemkey\_filepath: certs/elasticsearchNode.key > > \> searchguard.ssl.http.pemtrustedcas\_filepath: certs/root-ca.pem > > \> searchguard.allow\_unsafe\_democertificates: false > > \> searchguard.allow\_default\_init\_sgindex: false > > \> searchguard.authcz.admin\_dn: > > \> - CN=admin > > \> > > \> searchguard.ssl.http.enabled\_protocols: > > \> - "TLSv1.2" > > \> searchguard.ssl.transport.enabled\_protocols: > > \> - "TLSv1.2" > > \> > > \> searchguard.enterprise\_modules\_enabled: false > > \> > > \> Thanks in advance. > > \> > > \> -- > > \> You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > \> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com. > > \> To post to this group, send email to search...@googlegroups.com. > > \> To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/70be8831-f7f5-402b-a745-d62f2e4ade96%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/70be8831-f7f5-402b-a745-d62f2e4ade96%40googlegroups.com%5C). > > \> For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/db7f08d2-aecf-4161-b40b-f8722ab03e12%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/db7f08d2-aecf-4161-b40b-f8722ab03e12%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Jan\_Pesek](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@Jan\_Pesek](https://forum.search-guard.com/u/Jan_Pesek)\ **Post date:** [December 20, 2018, 12:01am UTC](https://forum.search-guard.com/t/invalid-certificates-after-offline-sgtool-generation/1253/5 "2018-12-20T00:01:08Z")
I found out, error comes only if I try to run multinode cluster and error is thrown when zen.pinging. My bad, the others nodes has different CA, because of older elastic running on same port I hate to bother you. Thanks for your time.