# search-guard-2 not working with ES 2.3.1

**URL:** <https://forum.search-guard.com/t/search-guard-2-not-working-with-es-2-3-1/190>\
**Category:** Search Guard\
**Created:** [June 14, 2016, 9:24am UTC](https://forum.search-guard.com/t/search-guard-2-not-working-with-es-2-3-1/190 "2016-06-14T09:24:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Guillaume\_Perreal](https://avatars.discourse-cdn.com/v4/letter/g/aca169/32.png) [@Guillaume\_Perreal](https://forum.search-guard.com/u/Guillaume_Perreal)\
**Post date:** [June 14, 2016, 9:24am UTC](https://forum.search-guard.com/t/search-guard-2-not-working-with-es-2-3-1/190/1 "2016-06-14T09:24:43Z")

</div>

Hello there,

I have succesfully set up a cluster of 3 nodes (elise1-elise3) with search-guard-ssl, but when it comes to search-guard-2, something fails with the certificates.

The server gives me this error at start (host names have been removed/changed in this dump):

com.floragunn.searchguard.ssl.SearchGuardKeyStore] Open SSL OpenSSL 1.0.1t 3 May 2016 available  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,238][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Open SSL OpenSSL 1.0.1t 3 May 2016 available  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,239][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Config directory is /etc/elasticsearch/, from there the key- and truststore files are resolved relatively  
[setting dump removed]  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,241][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Effective settings:  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,346][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 0 [removed for privacy]  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,347][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 1 CN=TERENA SSL CA 3, O=TERENA, L=Amsterdam, ST=Noord-Holland, C=NL  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,348][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 2 CN=DigiCert Assured ID Root CA, [OU=www.digicert.com](http://OU=www.digicert.com), O=DigiCert Inc, C=US  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,357][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP client auth mode OPTIONAL  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,366][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 0 [removed for privacy]  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,367][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 1 CN=TERENA SSL CA 3, O=TERENA, L=Amsterdam, ST=Noord-Holland, C=NL  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,367][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 2 CN=DigiCert Assured ID Root CA, [OU=www.digicert.com](http://OU=www.digicert.com), O=DigiCert Inc, C=US  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,784][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslTransportClientProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,785][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslTransportServerProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,785][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslHTTPProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,106][INFO][http] [elise1] Using [org.elasticsearch.http.netty.NettyHttpServerTransport] as http transport, overridden by [search-guard-ssl]  
juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,314][INFO][transport] [elise1] Using [com.floragunn.searchguard.transport.SearchGuardTransportService] as transport service, overridden by [search-guard2]  
juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,315][INFO][transport] [elise1] Using [com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] as transport, overridden by [search-guard-ssl]  
juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,727][INFO][node] [elise1] initialized  
juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,731][INFO][node] [elise1] starting …  
juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,830][INFO][com.floragunn.searchguard.transport.SearchGuardTransportService] [elise1] publish\_address {10.69.192.153:9300}, bound\_addresses {[::1]:9300}, {127.0.0.1:9300}, {10.69.192.153:9300}  
juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,838][INFO][discovery] [elise1] [elise.example.com/dhIpumhbQg6i\_D45-qvOUw](http://elise.example.com/dhIpumhbQg6i_D45-qvOUw)  
juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,863][DEBUG][action.admin.cluster.health] [elise1] no known master node, scheduling a retry  
juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,530][INFO][cluster.service] [elise1] detected\_master {elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{10.69.192.154:9300}, added {{elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{10.69.192.154:9300},{elise3}{HEBJdqcQTRmJNvGPiijo7g}{10.69.192.155}{10.69.192.155:9300},}, reason: zen-disco-receive(from master [{elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{10.69.192.154:9300}])  
juin 14 10:50:31 elise1 elasticsearch[999]: Exception in thread “Thread-4” ElasticsearchSecurityException[No SSL client certificates found. Search Guards needs the Search Guard SSL plugin to be installed]  
juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.transport.SearchGuardTransportService.messageReceivedDecorate(SearchGuardTransportService.java:204)  
juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardSSLTransportService$Interceptor.messageReceived(SearchGuardSSLTransportService.java:85)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.netty.MessageChannelHandler.handleRequest(MessageChannelHandler.java:245)  
juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.handleRequest(SearchGuardMessageChannelHandler.java:57)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:114)  
juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.messageReceived(SearchGuardMessageChannelHandler.java:45)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)  
juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)  
juin 14 10:50:31 elise1 elasticsearch[999]: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  
juin 14 10:50:31 elise1 elasticsearch[999]: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  
juin 14 10:50:31 elise1 elasticsearch[999]: at java.lang.Thread.run(Thread.java:745)  
juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,977][INFO][http] [elise1] publish\_address {10.69.192.153:9200}, bound\_addresses {[::1]:9200}, {127.0.0.1:9200}, {10.69.192.153:9200}  
juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,980][INFO][node] [elise1] started

And when trying to use the sgadmin tool, I get :

java -cp ‘/usr/share/elasticsearch/plugins/search-guard-ssl/_:/usr/share/elasticsearch/plugins/search-guard-2/_:/usr/share/elasticsearch/lib/\*’ com.floragunn.searchguard.tools.SearchGuardAdmin -ks /etc/elasticsearch/ssl/sgadmin.jks -kspass SOMEPASS -ts /etc/elasticsearch/ssl/truststore.jks -tspass SOMEPASS -cd /etc/elasticsearch/search-guard -h [elise1.lyon.cemagref.fr](http://elise1.lyon.cemagref.fr) -p 9300 -cn MYCLUSTERNAME  
Connect to [elise1.example.com:9300](http://elise1.example.com:9300)  
Exception in thread “main” NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{10.69.192.153}{[elise1.example.com/10.69.192.153:9300](http://elise1.example.com/10.69.192.153:9300)}]]  
at org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:290)  
at org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:207)  
at org.elasticsearch.client.transport.support.TransportProxyClient.execute(TransportProxyClient.java:55)  
at org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:288)  
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:359)  
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:348)  
at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:848)  
at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.health(AbstractClient.java:868)  
at com.floragunn.searchguard.tools.SearchGuardAdmin.main(SearchGuardAdmin.java:137)

The plugins seem to be correctly installed.

/usr/share/elasticsearch/bin/plugin list  
Installed plugins in /usr/share/elasticsearch/plugins:  
- search-guard-2  
- head  
- search-guard-ssl

All the certificates (one per node for transport, one for http, and one for the sgadmin user) have been signed by the same CA.

Any idea about these errors ?

Regards,  
Guillaume Perréal.

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [June 14, 2016, 10:15am UTC](https://forum.search-guard.com/t/search-guard-2-not-working-with-es-2-3-1/190/2 "2016-06-14T10:15:40Z")

</div>

Can you please upgrade to ES 2.3.3 and SG 2.3.3.0-rc1 and SG SSL 2.3.3.11 and try again?

> **···**
>
> > Am 14.06.2016 um 11:24 schrieb Guillaume Perréal \<guillaume.perreal@irstea.fr\>:
> > 
> > Hello there,
> > 
> > I have succesfully set up a cluster of 3 nodes (elise1-elise3) with search-guard-ssl, but when it comes to search-guard-2, something fails with the certificates.
> > 
> > The server gives me this error at start (host names have been removed/changed in this dump):
> > 
> > com.floragunn.searchguard.ssl.SearchGuardKeyStore] Open SSL OpenSSL 1.0.1t 3 May 2016 available  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,238][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Open SSL OpenSSL 1.0.1t 3 May 2016 available  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,239][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Config directory is /etc/elasticsearch/, from there the key- and truststore files are resolved relatively  
> > [setting dump removed]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,241][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Effective settings:  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,346][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 0 [removed for privacy]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,347][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 1 CN=TERENA SSL CA 3, O=TERENA, L=Amsterdam, ST=Noord-Holland, C=NL  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,348][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 2 CN=DigiCert Assured ID Root CA, [OU=www.digicert.com](http://OU=www.digicert.com), O=DigiCert Inc, C=US  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,357][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP client auth mode OPTIONAL  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,366][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 0 [removed for privacy]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,367][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 1 CN=TERENA SSL CA 3, O=TERENA, L=Amsterdam, ST=Noord-Holland, C=NL  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,367][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 2 CN=DigiCert Assured ID Root CA, [OU=www.digicert.com](http://OU=www.digicert.com), O=DigiCert Inc, C=US  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,784][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslTransportClientProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,785][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslTransportServerProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,785][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslHTTPProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
> > juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,106][INFO][http] [elise1] Using [org.elasticsearch.http.netty.NettyHttpServerTransport] as http transport, overridden by [search-guard-ssl]  
> > juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,314][INFO][transport] [elise1] Using [com.floragunn.searchguard.transport.SearchGuardTransportService] as transport service, overridden by [search-guard2]  
> > juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,315][INFO][transport] [elise1] Using [com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] as transport, overridden by [search-guard-ssl]  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,727][INFO][node] [elise1] initialized  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,731][INFO][node] [elise1] starting ...  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,830][INFO][com.floragunn.searchguard.transport.SearchGuardTransportService] [elise1] publish\_address {10.69.192.153:9300}, bound\_addresses {[::1]:9300}, {127.0.0.1:9300}, {10.69.192.153:9300}  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,838][INFO][discovery] [elise1] elise.example.com/dhIpumhbQg6i\_D45-qvOUw  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,863][DEBUG][action.admin.cluster.health] [elise1] no known master node, scheduling a retry  
> > juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,530][INFO][cluster.service] [elise1] detected\_master {elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{10.69.192.154:9300}, added {{elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{10.69.192.154:9300},{elise3}{HEBJdqcQTRmJNvGPiijo7g}{10.69.192.155}{10.69.192.155:9300},}, reason: zen-disco-receive(from master [{elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{10.69.192.154:9300}])  
> > juin 14 10:50:31 elise1 elasticsearch[999]: Exception in thread "Thread-4" ElasticsearchSecurityException[No SSL client certificates found. Search Guards needs the Search Guard SSL plugin to be installed]  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.transport.SearchGuardTransportService.messageReceivedDecorate(SearchGuardTransportService.java:204)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardSSLTransportService$Interceptor.messageReceived(SearchGuardSSLTransportService.java:85)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.netty.MessageChannelHandler.handleRequest(MessageChannelHandler.java:245)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.handleRequest(SearchGuardMessageChannelHandler.java:57)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:114)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.messageReceived(SearchGuardMessageChannelHandler.java:45)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at java.lang.Thread.run(Thread.java:745)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,977][INFO][http] [elise1] publish\_address {10.69.192.153:9200}, bound\_addresses {[::1]:9200}, {127.0.0.1:9200}, {10.69.192.153:9200}  
> > juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,980][INFO][node] [elise1] started
> > 
> > And when trying to use the sgadmin tool, I get :
> > 
> > java -cp '/usr/share/elasticsearch/plugins/search-guard-ssl/\*:/usr/share/elasticsearch/plugins/search-guard-2/\*:/usr/share/elasticsearch/lib/\*' com.floragunn.searchguard.tools.SearchGuardAdmin -ks /etc/elasticsearch/ssl/sgadmin.jks -kspass SOMEPASS -ts /etc/elasticsearch/ssl/truststore.jks -tspass SOMEPASS -cd /etc/elasticsearch/search-guard -h elise1.lyon.cemagref.fr -p 9300 -cn MYCLUSTERNAME  
> > Connect to elise1.example.com:9300  
> > Exception in thread "main" NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{10.69.192.153}{elise1.example.com/10.69.192.153:9300}]]  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:290)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:207)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.transport.support.TransportProxyClient.execute(TransportProxyClient.java:55)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:288)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:359)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:348)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:848)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.health(AbstractClient.java:868)  
> > &nbsp;&nbsp;&nbsp;&nbsp;at com.floragunn.searchguard.tools.SearchGuardAdmin.main(SearchGuardAdmin.java:137)
> > 
> > The plugins seem to be correctly installed.
> > 
> > /usr/share/elasticsearch/bin/plugin list  
> > Installed plugins in /usr/share/elasticsearch/plugins:  
> > &nbsp;&nbsp;&nbsp;&nbsp;- search-guard-2  
> > &nbsp;&nbsp;&nbsp;&nbsp;- head  
> > &nbsp;&nbsp;&nbsp;&nbsp;- search-guard-ssl
> > 
> > All the certificates (one per node for transport, one for http, and one for the sgadmin user) have been signed by the same CA.
> > 
> > Any idea about these errors ?
> > 
> > Regards,  
> > Guillaume Perréal.
> > 
> > --  
> > You received this message because you are subscribed to the Google Groups "Search Guard" group.  
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > To post to this group, send email to search-guard@googlegroups.com.  
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/779874c3-ce9c-4ea7-8a29-d4a061e21f08%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/779874c3-ce9c-4ea7-8a29-d4a061e21f08%40googlegroups.com%5C).  
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).

---

<div class="post-metadata">

**Author:** ![Guillaume\_Perreal](https://avatars.discourse-cdn.com/v4/letter/g/aca169/32.png) [@Guillaume\_Perreal](https://forum.search-guard.com/u/Guillaume_Perreal)\
**Post date:** [June 27, 2016, 2:21pm UTC](https://forum.search-guard.com/t/search-guard-2-not-working-with-es-2-3-1/190/3 "2016-06-27T14:21:57Z")

</div>

2.3.3 gave a more precise error. It turns out it was an issue with the node certificates. This is now fixed.

> **···**
>
> Le mardi 14 juin 2016 11:24:43 UTC+2, Guillaume Perréal a écrit :
> 
> > Hello there,
> > 
> > I have succesfully set up a cluster of 3 nodes (elise1-elise3) with search-guard-ssl, but when it comes to search-guard-2, something fails with the certificates.
> > 
> > The server gives me this error at start (host names have been removed/changed in this dump):
> > 
> > com.floragunn.searchguard.ssl.SearchGuardKeyStore] Open SSL OpenSSL 1.0.1t 3 May 2016 available  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,238][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Open SSL OpenSSL 1.0.1t 3 May 2016 available  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,239][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Config directory is /etc/elasticsearch/, from there the key- and truststore files are resolved relatively  
> > [setting dump removed]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,241][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Effective settings:  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,346][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 0 [removed for privacy]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,347][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 1 CN=TERENA SSL CA 3, O=TERENA, L=Amsterdam, ST=Noord-Holland, C=NL  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,348][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] Transport keystore subject DN no. 2 CN=DigiCert Assured ID Root CA, OU=[www.digicert.com](http://www.digicert.com), O=DigiCert Inc, C=US  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,357][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP client auth mode OPTIONAL  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,366][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 0 [removed for privacy]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,367][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 1 CN=TERENA SSL CA 3, O=TERENA, L=Amsterdam, ST=Noord-Holland, C=NL  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,367][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] HTTP keystore subject DN no. 2 CN=DigiCert Assured ID Root CA, OU=[www.digicert.com](http://www.digicert.com), O=DigiCert Inc, C=US  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,784][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslTransportClientProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,785][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslTransportServerProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
> > juin 14 10:50:24 elise1 elasticsearch[999]: [2016-06-14 10:50:24,785][INFO][com.floragunn.searchguard.ssl.SearchGuardKeyStore] sslHTTPProvider:OPENSSL with ciphers [TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA]  
> > juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,106][INFO][http] [elise1] Using [org.elasticsearch.http.netty.NettyHttpServerTransport] as http transport, overridden by [search-guard-ssl]  
> > juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,314][INFO][transport] [elise1] Using [com.floragunn.searchguard.transport.SearchGuardTransportService] as transport service, overridden by [search-guard2]  
> > juin 14 10:50:25 elise1 elasticsearch[999]: [2016-06-14 10:50:25,315][INFO][transport] [elise1] Using [com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] as transport, overridden by [search-guard-ssl]  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,727][INFO][node] [elise1] initialized  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,731][INFO][node] [elise1] starting …  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,830][INFO][com.floragunn.searchguard.transport.SearchGuardTransportService] [elise1] publish\_address {[10.69.192.153:9300](http://10.69.192.153:9300)}, bound\_addresses {[::1]:9300}, {[127.0.0.1:9300](http://127.0.0.1:9300)}, {[10.69.192.153:9300](http://10.69.192.153:9300)}  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,838][INFO][discovery] [elise1] [elise.example.com/dhIpumhbQg6i\_D45-qvOUw](http://elise.example.com/dhIpumhbQg6i_D45-qvOUw)  
> > juin 14 10:50:27 elise1 elasticsearch[999]: [2016-06-14 10:50:27,863][DEBUG][action.admin.cluster.health] [elise1] no known master node, scheduling a retry  
> > juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,530][INFO][cluster.service] [elise1] detected\_master {elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{[10.69.192.154:9300](http://10.69.192.154:9300)}, added {{elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{[10.69.192.154:9300](http://10.69.192.154:9300)},{elise3}{HEBJdqcQTRmJNvGPiijo7g}{10.69.192.155}{[10.69.192.155:9300](http://10.69.192.155:9300)},}, reason: zen-disco-receive(from master [{elise2}{Cjv2-hc1T-qKpMZ75-Vnww}{10.69.192.154}{10.69.192.154:9300}])  
> > juin 14 10:50:31 elise1 elasticsearch[999]: Exception in thread “Thread-4” ElasticsearchSecurityException[No SSL client certificates found. Search Guards needs the Search Guard SSL plugin to be installed]  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.transport.SearchGuardTransportService.messageReceivedDecorate(SearchGuardTransportService.java:204)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardSSLTransportService$Interceptor.messageReceived(SearchGuardSSLTransportService.java:85)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.netty.MessageChannelHandler.handleRequest(MessageChannelHandler.java:245)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.handleRequest(SearchGuardMessageChannelHandler.java:57)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:114)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at com.floragunn.searchguard.ssl.transport.SearchGuardMessageChannelHandler.messageReceived(SearchGuardMessageChannelHandler.java:45)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: at java.lang.Thread.run(Thread.java:745)  
> > juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,977][INFO][http] [elise1] publish\_address {[10.69.192.153:9200](http://10.69.192.153:9200)}, bound\_addresses {[::1]:9200}, {[127.0.0.1:9200](http://127.0.0.1:9200)}, {[10.69.192.153:9200](http://10.69.192.153:9200)}  
> > juin 14 10:50:31 elise1 elasticsearch[999]: [2016-06-14 10:50:31,980][INFO][node] [elise1] started
> > 
> > And when trying to use the sgadmin tool, I get :
> > 
> > java -cp ‘/usr/share/elasticsearch/plugins/search-guard-ssl/_:/usr/share/elasticsearch/plugins/search-guard-2/_:/usr/share/elasticsearch/lib/\*’ com.floragunn.searchguard.tools.SearchGuardAdmin -ks /etc/elasticsearch/ssl/sgadmin.jks -kspass SOMEPASS -ts /etc/elasticsearch/ssl/truststore.jks -tspass SOMEPASS -cd /etc/elasticsearch/search-guard -h [elise1.lyon.cemagref.fr](http://elise1.lyon.cemagref.fr) -p 9300 -cn MYCLUSTERNAME  
> > Connect to [elise1.example.com:9300](http://elise1.example.com:9300)  
> > Exception in thread “main” NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{10.69.192.153}{elise1.[example.com](http://example.com)/10.69.192.153:9300}]]  
> > at org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:290)  
> > at org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:207)  
> > at org.elasticsearch.client.transport.support.TransportProxyClient.execute(TransportProxyClient.java:55)  
> > at org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:288)  
> > at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:359)  
> > at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:348)  
> > at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:848)  
> > at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.health(AbstractClient.java:868)  
> > at com.floragunn.searchguard.tools.SearchGuardAdmin.main(SearchGuardAdmin.java:137)
> > 
> > The plugins seem to be correctly installed.
> > 
> > /usr/share/elasticsearch/bin/plugin list  
> > Installed plugins in /usr/share/elasticsearch/plugins:  
> > - search-guard-2  
> > - head  
> > - search-guard-ssl
> > 
> > All the certificates (one per node for transport, one for http, and one for the sgadmin user) have been signed by the same CA.
> > 
> > Any idea about these errors ?
> > 
> > Regards,  
> > Guillaume Perréal.