# Optional: Client authentication Failed

**URL:** <https://forum.search-guard.com/t/optional-client-authentication-failed/226>\
**Category:** Search Guard\
**Created:** [July 7, 2016, 8:06am UTC](https://forum.search-guard.com/t/optional-client-authentication-failed/226 "2016-07-07T08:06:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![miao.work2010](https://avatars.discourse-cdn.com/v4/letter/m/bc8723/32.png) [@miao.work2010](https://forum.search-guard.com/u/miao.work2010)\
**Post date:** [July 7, 2016, 8:06am UTC](https://forum.search-guard.com/t/optional-client-authentication-failed/226/1 "2016-07-07T08:06:05Z")

</div>

I read the document: [https://github.com/floragunncom/search-guard-ssl-docs/blob/master/quickstart.md](https://github.com/floragunncom/search-guard-ssl-docs/blob/master/quickstart.md), and I set up a test environment on my own mac, but try "Optional: Client authentication” failed, I need your help.

**ES Error log:**

[2016-07-07 14:20:48,524][ERROR][com.floragunn.searchguard.ssl.http.netty.SearchGuardSSLNettyHttpServerTransport] [node-0] SSL Problem null cert chain

javax.net.ssl.SSLHandshakeException: null cert chain

```
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)

at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)

at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)

at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)

at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)

at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)

at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)

at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)

at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)

at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)

at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)

at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)

at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)

at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)

at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)

at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)

at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at java.lang.Thread.run(Thread.java:745)

```

Caused by: javax.net.ssl.SSLHandshakeException: null cert chain

```
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:292)

at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1804)

at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:222)

at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)

at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)

at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)

at java.security.AccessController.doPrivileged(Native Method)

at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)

at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392)

at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255)

... 18 more

```

[2016-07-07 14:21:35,281][ERROR][com.floragunn.searchguard.ssl.http.netty.SearchGuardSSLNettyHttpServerTransport]

**My OSX Chrome:**

ERR\_BAD\_SSL\_CLIENT\_AUTH\_CERT

I try import kirk-signed.pem and kirk.crt.pem into my chrome, but all failed.(kirk-keystore.jks、kirk-keystore.p12、kirk-signed.pem、kirk.crt.pem、kirk.csr、kirk.key.pem)

ES: elasticsearch-2.3.3

Search Guard SSL: search-guard-ssl-2.3.3.13

elasticsearch.yml

node.name: node-0

network.host: 127.0.0.1

searchguard.ssl.transport.enabled: true

searchguard.ssl.transport.keystore\_filepath: node-0-keystore.jks

searchguard.ssl.transport.keystore\_password: changeit

searchguard.ssl.transport.truststore\_filepath: truststore.jks

searchguard.ssl.transport.truststore\_password: changeit

searchguard.ssl.transport.enforce\_hostname\_verification: false

searchguard.ssl.http.enabled: true

searchguard.ssl.http.keystore\_filepath: node-0-keystore.jks

searchguard.ssl.http.keystore\_password: changeit

searchguard.ssl.http.truststore\_filepath: truststore.jks

searchguard.ssl.http.truststore\_password: changeit

searchguard.ssl.http.clientauth\_mode: REQUIRE

Please help me, Thanks.

---

<div class="post-metadata">

**Author:** ![Breno\_Inojosa](https://avatars.discourse-cdn.com/v4/letter/b/bb73d2/32.png) [@Breno\_Inojosa](https://forum.search-guard.com/u/Breno_Inojosa)\
**Post date:** [August 3, 2016, 8:48pm UTC](https://forum.search-guard.com/t/optional-client-authentication-failed/226/2 "2016-08-03T20:48:19Z")

</div>

Were you able to solve this issue? I’m having the same problem.

> **···**
>
> On Thursday, July 7, 2016 at 5:06:05 AM UTC-3, [miao.w...@gmail.com](mailto:miao.w...@gmail.com) wrote:
> 
> > I read the document: [https://github.com/floragunncom/search-guard-ssl-docs/blob/master/quickstart.md](https://github.com/floragunncom/search-guard-ssl-docs/blob/master/quickstart.md), and I set up a test environment on my own mac, but try "Optional: Client authentication” failed, I need your help.
> 
> > 
> 
> > **ES Error log:**
> 
> > 
> 
> > [2016-07-07 14:20:48,524][ERROR][com.floragunn.searchguard.ssl.http.netty.SearchGuardSSLNettyHttpServerTransport] [node-0] SSL Problem null cert chain
> 
> > javax.net.ssl.SSLHandshakeException: null cert chain
> 
> > ```
> > at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
> > 
> > ```
> 
> > ```
> > at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
> > 
> > ```
> 
> > ```
> > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> > 
> > ```
> 
> > ```
> > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> > 
> > ```
> 
> > ```
> > at java.lang.Thread.run(Thread.java:745)
> > 
> > ```
> 
> > Caused by: javax.net.ssl.SSLHandshakeException: null cert chain
> 
> > ```
> > at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:292)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1804)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:222)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)
> > 
> > ```
> 
> > ```
> > at java.security.AccessController.doPrivileged(Native Method)
> > 
> > ```
> 
> > ```
> > at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392)
> > 
> > ```
> 
> > ```
> > at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255)
> > 
> > ```
> 
> > ```
> > ... 18 more
> > 
> > ```
> 
> > [2016-07-07 14:21:35,281][ERROR][com.floragunn.searchguard.ssl.http.netty.SearchGuardSSLNettyHttpServerTransport]
> 
> > 
> 
> > **My OSX Chrome:**
> 
> > 
> 
> > ERR\_BAD\_SSL\_CLIENT\_AUTH\_CERT
> 
> > 
> 
> > I try import kirk-signed.pem and kirk.crt.pem into my chrome, but all failed.(kirk-keystore.jks、kirk-keystore.p12、kirk-signed.pem、kirk.crt.pem、kirk.csr、kirk.key.pem)
> 
> > 
> 
> > ES: elasticsearch-2.3.3
> 
> > 
> 
> > Search Guard SSL: search-guard-ssl-2.3.3.13
> 
> > 
> 
> > elasticsearch.yml
> 
> > 
> 
> > 
> 
> > [node.name](http://node.name): node-0
> 
> > 
> 
> > 
> 
> > network.host: 127.0.0.1
> 
> > 
> 
> > searchguard.ssl.transport.enabled: true
> 
> > searchguard.ssl.transport.keystore\_filepath: node-0-keystore.jks
> 
> > searchguard.ssl.transport.keystore\_password: changeit
> 
> > searchguard.ssl.transport.truststore\_filepath: truststore.jks
> 
> > searchguard.ssl.transport.truststore\_password: changeit
> 
> > searchguard.ssl.transport.enforce\_hostname\_verification: false
> 
> > 
> 
> > searchguard.ssl.http.enabled: true
> 
> > searchguard.ssl.http.keystore\_filepath: node-0-keystore.jks
> 
> > searchguard.ssl.http.keystore\_password: changeit
> 
> > searchguard.ssl.http.truststore\_filepath: truststore.jks
> 
> > searchguard.ssl.http.truststore\_password: changeit
> 
> > 
> 
> > 
> 
> > searchguard.ssl.http.clientauth\_mode: REQUIRE
> 
> > 
> 
> > Please help me, Thanks.
> 
> > 
> 
> >

---

<div class="post-metadata">

**Author:** ![Sam\_Mingolelli](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@Sam\_Mingolelli](https://forum.search-guard.com/u/Sam_Mingolelli)\
**Post date:** [August 10, 2016, 6:16pm UTC](https://forum.search-guard.com/t/optional-client-authentication-failed/226/3 "2016-08-10T18:16:33Z")

</div>

Same here. I tried doing curl commands using all the generated .pem files and none worked as --cacert files to curl when I enabled searchguard.ssl.http.clientauth\_mode: REQUIRE.

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [August 12, 2016, 8:37am UTC](https://forum.search-guard.com/t/optional-client-authentication-failed/226/4 "2016-08-12T08:37:50Z")

</div>

cat ./example-pki-scripts/kirk.crt.pem ./example-pki-scripts/ca/chain-ca.pem \> ./kirk-cert-chain.pem  
curl -k https://localhost:9200/\_searchguard/sslinfo?pretty -E ./kirk-cert-chain.pem --key ./example-pki-scripts/kirk.key.pem

{  
“principal” : “CN=kirk,OU=client,O=client,L=Test,C=DE”,  
“peer\_certificates” : “3”,  
“ssl\_protocol” : “TLSv1.2”,  
“ssl\_cipher” : “TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256”,  
“ssl\_openssl\_available” : true,  
“ssl\_openssl\_version” : 268439663,  
“ssl\_openssl\_version\_string” : “OpenSSL 1.0.1f 6 Jan 2014”,  
“ssl\_openssl\_non\_available\_cause” : “”,  
“ssl\_provider\_http” : “OPENSSL”,  
“ssl\_provider\_transport\_server” : “OPENSSL”,  
“ssl\_provider\_transport\_client” : “OPENSSL”  
}

> **···**
>
> On Wednesday, 10 August 2016 20:16:33 UTC+2, Sam Mingolelli wrote:
> 
> > Same here. I tried doing curl commands using all the generated .pem files and none worked as --cacert files to curl when I enabled searchguard.ssl.http.clientauth\_mode: REQUIRE.

---

<div class="post-metadata">

**Author:** ![Tom\_G](https://avatars.discourse-cdn.com/v4/letter/t/f19dbf/32.png) [@Tom\_G](https://forum.search-guard.com/u/Tom_G)\
**Post date:** [February 22, 2017, 7:39pm UTC](https://forum.search-guard.com/t/optional-client-authentication-failed/226/5 "2017-02-22T19:39:35Z")

</div>

Running this gives me:

curl: (58) SSL: Can’t load the certificate “./kirk-cert-chain.pem” and its private key: OSStatus -25299

Does anyone know which of the generated certs I would use to use the JS ES client? I keep getting error:140890C7:SSL routines:ssl3\_get\_client\_certificate:peer did not return a certificate

> **···**
>
> On Friday, August 12, 2016 at 4:37:51 AM UTC-4, Search Guard wrote:
> 
> > cat ./example-pki-scripts/kirk.crt.pem ./example-pki-scripts/ca/chain-ca.pem \> ./kirk-cert-chain.pem  
> > curl -k https://localhost:9200/\_searchguard/sslinfo?pretty -E ./kirk-cert-chain.pem --key ./example-pki-scripts/kirk.key.pem
> 
> > {  
> > “principal” : “CN=kirk,OU=client,O=client,L=Test,C=DE”,  
> > “peer\_certificates” : “3”,  
> > “ssl\_protocol” : “TLSv1.2”,  
> > “ssl\_cipher” : “TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256”,  
> > “ssl\_openssl\_available” : true,  
> > “ssl\_openssl\_version” : 268439663,  
> > “ssl\_openssl\_version\_string” : “OpenSSL 1.0.1f 6 Jan 2014”,  
> > “ssl\_openssl\_non\_available\_cause” : “”,  
> > “ssl\_provider\_http” : “OPENSSL”,  
> > “ssl\_provider\_transport\_server” : “OPENSSL”,  
> > “ssl\_provider\_transport\_client” : “OPENSSL”  
> > }
> 
> > 
> 
> > 
> 
> > On Wednesday, 10 August 2016 20:16:33 UTC+2, Sam Mingolelli wrote:
> > 
> > > Same here. I tried doing curl commands using all the generated .pem files and none worked as --cacert files to curl when I enabled searchguard.ssl.http.clientauth\_mode: REQUIRE.