# Newbie Setup Issue: Rest Layer TLS and "SSL Problem null cert chain"

**URL:** <https://forum.search-guard.com/t/newbie-setup-issue-rest-layer-tls-and-ssl-problem-null-cert-chain/841>\
**Category:** Search Guard\
**Created:** [March 16, 2018, 3:59pm UTC](https://forum.search-guard.com/t/newbie-setup-issue-rest-layer-tls-and-ssl-problem-null-cert-chain/841 "2018-03-16T15:59:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![michael1](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@michael1](https://forum.search-guard.com/u/michael1)\
**Post date:** [March 16, 2018, 3:59pm UTC](https://forum.search-guard.com/t/newbie-setup-issue-rest-layer-tls-and-ssl-problem-null-cert-chain/841/1 "2018-03-16T15:59:50Z")

</div>

Hello,

I’m trying to get a fresh install of ES 6.2 / search-guard-ssl up and running. My primary interest is securing the REST endpoints with TLS. I’ve generated my SSL setup with search-guard-tls-tool with the following config:

ca:

root:

dn: [CN=root.ca.example.com](http://CN=root.ca.example.com),OU=CA,O=example Com, Inc.,DC=example,DC=com

keysize: 2048

validityDays: 3650

pkPassword: auto

file: root-ca.pem

intermediate:

dn: [CN=signing.ca.example.com](http://CN=signing.ca.example.com),OU=CA,O=example Com, Inc.,DC=example,DC=com

keysize: 2048

validityDays: 3650

pkPassword: auto

defaults:

validityDays: 3650

pkPassword: auto

generatedPasswordLength: 12

httpsEnabled: true

reuseTransportCertificatesForHttp: true

verifyHostnames: false

resolveHostnames: false

nodes:

- name: node1

dn: [CN=node1.example.com](http://CN=node1.example.com),OU=Ops,O=example Com, Inc.,DC=example,DC=com

dns: [node1.example.com](http://node1.example.com)

``

This generated a config as follows:

searchguard.ssl.transport.pemcert\_filepath: node1.pem

searchguard.ssl.transport.pemkey\_filepath: node1.key

searchguard.ssl.transport.pemkey\_password: XXX

searchguard.ssl.transport.pemtrustedcas\_filepath: root-ca.pem

searchguard.ssl.transport.enforce\_hostname\_verification: false

searchguard.ssl.transport.resolve\_hostname: false

searchguard.ssl.http.enabled: true

searchguard.ssl.http.pemcert\_filepath: node1.pem

searchguard.ssl.http.pemkey\_filepath: node1.key

searchguard.ssl.http.pemkey\_password: XXX

searchguard.ssl.http.pemtrustedcas\_filepath: root-ca.pem

searchguard.ssl.http.clientauth\_mode: NONE

``

I added the “searchguard.ssl.http.clientauth\_mode: NONE”

ES starts up without any issue. when trying to access:

curl -k [https://localhost:9300/](https://localhost:9300/)

``

I get the client side error:

curl: (35) error:14094412:SSL routines:ssl3\_read\_bytes:sslv3 alert bad certificate

``

And the ES log shows:

[2018-03-16T12:58:11,916][ERROR][c.f.s.s.t.SearchGuardSSLNettyTransport] [node1] SSL Problem null cert chain

javax.net.ssl.SSLHandshakeException: null cert chain

``

What am I doing wrong?

Thanks,

Mike

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [March 16, 2018, 4:04pm UTC](https://forum.search-guard.com/t/newbie-setup-issue-rest-layer-tls-and-ssl-problem-null-cert-chain/841/2 "2018-03-16T16:04:57Z")

</div>

curl -k [https://localhost:9200/](https://localhost:9200/)  
(instead of 9300 which is the transport layer port, not the http port)

> **···**
>
> On Friday, 16 March 2018 16:59:50 UTC+1, mic…@…al wrote:
> 
> > Hello,
> 
> > 
> 
> > I’m trying to get a fresh install of ES 6.2 / search-guard-ssl up and running. My primary interest is securing the REST endpoints with TLS. I’ve generated my SSL setup with search-guard-tls-tool with the following config:
> 
> > 
> 
> > ca:
> 
> > root:
> 
> > dn: CN=[root.ca.example.com](http://root.ca.example.com),OU=CA,O=example Com, Inc.,DC=example,DC=com
> 
> > keysize: 2048
> 
> > validityDays: 3650
> 
> > pkPassword: auto
> 
> > file: root-ca.pem
> 
> > intermediate:
> 
> > dn: CN=[signing.ca.example.com](http://signing.ca.example.com),OU=CA,O=example Com, Inc.,DC=example,DC=com
> 
> > keysize: 2048
> 
> > validityDays: 3650
> 
> > pkPassword: auto
> 
> > defaults:
> 
> > validityDays: 3650
> 
> > pkPassword: auto
> 
> > generatedPasswordLength: 12
> 
> > httpsEnabled: true
> 
> > reuseTransportCertificatesForHttp: true
> 
> > verifyHostnames: false
> 
> > resolveHostnames: false
> 
> > nodes:
> 
> > - name: node1
> 
> > dn: CN=[node1.example.com](http://node1.example.com),OU=Ops,O=example Com, Inc.,DC=example,DC=com
> 
> > dns: [node1.example.com](http://node1.example.com)
> 
> > ``
> 
> > 
> 
> > This generated a config as follows:
> 
> > 
> 
> > searchguard.ssl.transport.pemcert\_filepath: node1.pem
> 
> > searchguard.ssl.transport.pemkey\_filepath: node1.key
> 
> > searchguard.ssl.transport.pemkey\_password: XXX
> 
> > searchguard.ssl.transport.pemtrustedcas\_filepath: root-ca.pem
> 
> > searchguard.ssl.transport.enforce\_hostname\_verification: false
> 
> > searchguard.ssl.transport.resolve\_hostname: false
> 
> > searchguard.ssl.http.enabled: true
> 
> > searchguard.ssl.http.pemcert\_filepath: node1.pem
> 
> > searchguard.ssl.http.pemkey\_filepath: node1.key
> 
> > searchguard.ssl.http.pemkey\_password: XXX
> 
> > searchguard.ssl.http.pemtrustedcas\_filepath: root-ca.pem
> 
> > searchguard.ssl.http.clientauth\_mode: NONE
> 
> > ``
> 
> > 
> 
> > I added the “searchguard.ssl.http.clientauth\_mode: NONE”
> 
> > 
> 
> > 
> 
> > ES starts up without any issue. when trying to access:
> 
> > 
> 
> > curl -k [https://localhost:9300/](https://localhost:9300/)
> 
> > ``
> 
> > 
> 
> > I get the client side error:
> 
> > 
> 
> > curl: (35) error:14094412:SSL routines:ssl3\_read\_bytes:sslv3 alert bad certificate
> 
> > ``
> 
> > 
> 
> > And the ES log shows:
> 
> > 
> 
> > [2018-03-16T12:58:11,916][ERROR][c.f.s.s.t.SearchGuardSSLNettyTransport] [node1] SSL Problem null cert chain
> 
> > javax.net.ssl.SSLHandshakeException: null cert chain
> 
> > 
> 
> > ``
> 
> > 
> 
> > 
> 
> > What am I doing wrong?
> 
> > 
> 
> > 
> 
> > Thanks,
> 
> > 
> 
> > Mike
> 
> >

---

<div class="post-metadata">

**Author:** ![michael1](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@michael1](https://forum.search-guard.com/u/michael1)\
**Post date:** [March 16, 2018, 4:34pm UTC](https://forum.search-guard.com/t/newbie-setup-issue-rest-layer-tls-and-ssl-problem-null-cert-chain/841/3 "2018-03-16T16:34:08Z")

</div>

Hallelujah! (palm slap)

Thanks!

> **···**
>
> On Friday, March 16, 2018 at 1:04:57 PM UTC-3, Search Guard wrote:
> 
> > curl -k [https://localhost:9200/](https://localhost:9200/)  
> > (instead of 9300 which is the transport layer port, not the http port)
> > 
> > On Friday, 16 March 2018 16:59:50 UTC+1, mic…@…al wrote:
> > 
> > > Hello,
> 
> > >
> 
> > > I’m trying to get a fresh install of ES 6.2 / search-guard-ssl up and running. My primary interest is securing the REST endpoints with TLS. I’ve generated my SSL setup with search-guard-tls-tool with the following config:
> 
> > >
> 
> > > ca:
> 
> > > root:
> 
> > > dn: CN=[root.ca.example.com](http://root.ca.example.com),OU=CA,O=example Com, Inc.,DC=example,DC=com
> 
> > > keysize: 2048
> 
> > > validityDays: 3650
> 
> > > pkPassword: auto
> 
> > > file: root-ca.pem
> 
> > > intermediate:
> 
> > > dn: CN=[signing.ca.example.com](http://signing.ca.example.com),OU=CA,O=example Com, Inc.,DC=example,DC=com
> 
> > > keysize: 2048
> 
> > > validityDays: 3650
> 
> > > pkPassword: auto
> 
> > > defaults:
> 
> > > validityDays: 3650
> 
> > > pkPassword: auto
> 
> > > generatedPasswordLength: 12
> 
> > > httpsEnabled: true
> 
> > > reuseTransportCertificatesForHttp: true
> 
> > > verifyHostnames: false
> 
> > > resolveHostnames: false
> 
> > > nodes:
> 
> > > - name: node1
> 
> > > dn: CN=[node1.example.com](http://node1.example.com),OU=Ops,O=example Com, Inc.,DC=example,DC=com
> 
> > > dns: [node1.example.com](http://node1.example.com)
> 
> > > ``
> 
> > >
> 
> > > This generated a config as follows:
> 
> > >
> 
> > > searchguard.ssl.transport.pemcert\_filepath: node1.pem
> 
> > > searchguard.ssl.transport.pemkey\_filepath: node1.key
> 
> > > searchguard.ssl.transport.pemkey\_password: XXX
> 
> > > searchguard.ssl.transport.pemtrustedcas\_filepath: root-ca.pem
> 
> > > searchguard.ssl.transport.enforce\_hostname\_verification: false
> 
> > > searchguard.ssl.transport.resolve\_hostname: false
> 
> > > searchguard.ssl.http.enabled: true
> 
> > > searchguard.ssl.http.pemcert\_filepath: node1.pem
> 
> > > searchguard.ssl.http.pemkey\_filepath: node1.key
> 
> > > searchguard.ssl.http.pemkey\_password: XXX
> 
> > > searchguard.ssl.http.pemtrustedcas\_filepath: root-ca.pem
> 
> > > searchguard.ssl.http.clientauth\_mode: NONE
> 
> > > ``
> 
> > >
> 
> > > I added the “searchguard.ssl.http.clientauth\_mode: NONE”
> 
> > >
> 
> > >
> 
> > > ES starts up without any issue. when trying to access:
> 
> > >
> 
> > > curl -k [https://localhost:9300/](https://localhost:9300/)
> 
> > > ``
> 
> > >
> 
> > > I get the client side error:
> 
> > >
> 
> > > curl: (35) error:14094412:SSL routines:ssl3\_read\_bytes:sslv3 alert bad certificate
> 
> > > ``
> 
> > >
> 
> > > And the ES log shows:
> 
> > >
> 
> > > [2018-03-16T12:58:11,916][ERROR][c.f.s.s.t.SearchGuardSSLNettyTransport] [node1] SSL Problem null cert chain
> 
> > > javax.net.ssl.SSLHandshakeException: null cert chain
> 
> > >
> 
> > > ``
> 
> > >
> 
> > >
> 
> > > What am I doing wrong?
> 
> > >
> 
> > >
> 
> > > Thanks,
> 
> > >
> 
> > > Mike
> 
> > >