# sgadmin.sh failure - Search Guard not initialized (SG11) for indices:admin/exists 5.5.2

**URL:** <https://forum.search-guard.com/t/sgadmin-sh-failure-search-guard-not-initialized-sg11-for-indices-admin-exists-5-5-2/588>\
**Category:** Search Guard\
**Created:** [August 31, 2017, 3:02pm UTC](https://forum.search-guard.com/t/sgadmin-sh-failure-search-guard-not-initialized-sg11-for-indices-admin-exists-5-5-2/588 "2017-08-31T15:02:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![malywut](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@malywut](https://forum.search-guard.com/u/malywut)\
**Post date:** [August 31, 2017, 3:02pm UTC](https://forum.search-guard.com/t/sgadmin-sh-failure-search-guard-not-initialized-sg11-for-indices-admin-exists-5-5-2/588/1 "2017-08-31T15:02:35Z")

</div>

Hi,

I am trying to get SearchGuard to work with a production like setting.

I have configured the keystore/truststore settings using the examples found here : [https://github.com/floragunncom/search-guard-ssl/tree/es-5.5.2/example-pki-scripts](https://github.com/floragunncom/search-guard-ssl/tree/es-5.5.2/example-pki-scripts)  
My 4 node cluster is up and running (so keystore/truststore configuration works for the transport layer TLS).

I then added an admin certificate to the keystore, the same way I did for the nodes (using this example : [https://github.com/floragunncom/search-guard-ssl/blob/es-5.5.2/example-pki-scripts/gen\_node\_cert\_openssl.sh](https://github.com/floragunncom/search-guard-ssl/blob/es-5.5.2/example-pki-scripts/gen_node_cert_openssl.sh))

I then added the admin keystore to the node keystore to have one unique keystore.

keytool -list -storetype pkcs12 -keystore /etc/elasticsearch/node1/keystore\_es.p12

``

Gives :

Keystore type: PKCS12  
Keystore provider: SunJSSE

Your keystore contains 2 entries

1, Aug 31, 2017, PrivateKeyEntry,  
Certificate fingerprint (SHA1): CF:A1:E2:C1:35:85:5B:A5:49:7B:E1:8B:9F:6A:65:C7:45:39:3A:3C  
admin, Aug 31, 2017, PrivateKeyEntry,  
Certificate fingerprint (SHA1): BE:35:51:43:65:AB:B9:A0:8D:2C:C7:6A:B8:DB:29:A5:8F:07:B2:E9

``

I checked the searchguard.authcz.admin\_dn configuration.

However, when I run  
sh tools/sgadmin.sh -icl -nhnv -ks /etc/elasticsearch/node1/keystore\_es.p12 -ksalias admin -ts /etc/elasticsearch/node1/truststore\_es.jks

``

Output :

Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate …  
Clustername: elasticsearch  
Clusterstate: GREEN  
Number of nodes: 4  
Number of data nodes: 3

``

and at the same time, in the elasticsearch log file :  
[2017-08-31T16:48:11,078][ERROR][c.f.s.c.ConfigurationLoader] Failure no such index retrieving configuration for [roles] (index=searchguard)

``

and after a minute in the stdout :  
ERR: An unexpected ElasticsearchSecurityException occured: Search Guard not initialized (SG11) for indices:admin/exists. See https://[github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md](http://github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md)  
Trace:  
ElasticsearchSecurityException[Search Guard not initialized (SG11) for indices:admin/exists. See https://[github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md](http://github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md)]  
at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:128)  
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168)  
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142)  
at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64)  
at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54)  
at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:178)  
at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:192)  
at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:140)  
at com.floragunn.searchguard.SearchGuardPlugin$3$1.messageReceived(SearchGuardPlugin.java:376)  
at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69)  
at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544)  
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)  
at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110)  
at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501)  
at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385)  
at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310)  
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297)  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413)  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267)  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078)  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489)  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428)  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926)  
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134)  
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644)  
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544)  
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498)  
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458)  
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)  
at java.lang.Thread.run(Thread.java:748)

``

and at the same time in the elasticsearch log file :

[2017-08-31T16:50:49,129][ERROR][c.f.s.c.IndexBaseConfigurationRepository] Unable to load configuration because of java.util.concurrent.TimeoutException: Timeout after 1MINUTES while retrieving configuration for roles  
java.util.concurrent.TimeoutException: Timeout after 1MINUTES while retrieving configuration for roles  
at com.floragunn.searchguard.configuration.ConfigurationLoader.load(ConfigurationLoader.java:103) ~[search-guard-5-5.5.2-15.jar:?]  
at com.floragunn.searchguard.configuration.IndexBaseConfigurationRepository.loadConfigurations(IndexBaseConfigurationRepository.java:361) [search-guard-5-5.5.2-15.jar:?]  
at com.floragunn.searchguard.configuration.IndexBaseConfigurationRepository.getConfiguration(IndexBaseConfigurationRepository.java:206) [search-guard-5-5.5.2-15.jar:?]  
at com.floragunn.searchguard.configuration.PrivilegesEvaluator.getRolesSettings(PrivilegesEvaluator.java:173) [search-guard-5-5.5.2-15.jar:?]  
at com.floragunn.searchguard.configuration.PrivilegesEvaluator.isInitialized(PrivilegesEvaluator.java:185) [search-guard-5-5.5.2-15.jar:?]  
at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:126) [search-guard-5-5.5.2-15.jar:?]  
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) [elasticsearch-5.5.2.jar:5.5.2]  
at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:178) [search-guard-ssl-5.5.2-23.jar:5.5.2-23]  
at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:192) [search-guard-5-5.5.2-15.jar:?]  
at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:140) [search-guard-ssl-5.5.2-23.jar:5.5.2-23]  
at com.floragunn.searchguard.SearchGuardPlugin$3$1.messageReceived(SearchGuardPlugin.java:376) [search-guard-5-5.5.2-15.jar:?]  
at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) [elasticsearch-5.5.2.jar:5.5.2]  
at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) [transport-netty4-client-5.5.2.jar:5.5.2]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) [netty-handler-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) [netty-handler-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.11.Final.jar:4.1.11.Final]  
at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_141]  
[2017-08-31T16:50:49,131][ERROR][c.f.s.f.SearchGuardFilter] Search Guard not initialized (SG11) for indices:admin/exists

``

The diagnose trace :

Diagnostic sgadmin trace  
ES client version: 5.5.2  
Client properties: {java.runtime.name=OpenJDK Runtime Environment, sun.boot.library.path=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.el7\_3.x86\_64/jre/lib/amd64, java.vm.version=25.141-b16, jdk.tls.rejectClientInitiatedRenegotiation=true, java.vm.vendor=Oracle Corporation, java.vendor.url=[http://java.oracle.com/](http://java.oracle.com/), path.separator=:, java.vm.name=OpenJDK 64-Bit Server VM, [file.encoding.pkg=sun.io](http://file.encoding.pkg=sun.io), user.country=US, sun.java.launcher=SUN\_STANDARD, sun.os.patch.level=unknown, java.vm.specification.name=Java Virtual Machine Specification, user.dir=/usr/share/elasticsearch/plugins/search-guard-5, sg.nowarn.client=true, java.runtime.version=1.8.0\_141-b16, java.awt.graphicsenv=sun.awt.X11GraphicsEnvironment, java.endorsed.dirs=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.el7\_3.x86\_64/jre/lib/endorsed, os.arch=amd64, java.io.tmpdir=/tmp, line.separator=

Any help would be much appreciated…

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [September 1, 2017, 7:38pm UTC](https://forum.search-guard.com/t/sgadmin-sh-failure-search-guard-not-initialized-sg11-for-indices-admin-exists-5-5-2/588/2 "2017-09-01T19:38:46Z")

</div>

Pls provide the outout of “keytool -list -v -storetype pkcs12 -keystore /etc/elasticsearch/node1/keystore\_es.p12” (mind the -v option) and post your complete elasticsearch.yml

My guess is that the certificate stored under the admin alias does not match the one configured in searchguard.authcz.admin\_dn

> **···**
>
> On Thursday, 31 August 2017 17:02:35 UTC+2, malywut wrote:
> 
> > Hi,
> > 
> > I am trying to get SearchGuard to work with a production like setting.
> > 
> > I have configured the keystore/truststore settings using the examples found here : [https://github.com/floragunncom/search-guard-ssl/tree/es-5.5.2/example-pki-scripts](https://github.com/floragunncom/search-guard-ssl/tree/es-5.5.2/example-pki-scripts)  
> > My 4 node cluster is up and running (so keystore/truststore configuration works for the transport layer TLS).
> > 
> > I then added an admin certificate to the keystore, the same way I did for the nodes (using this example : [https://github.com/floragunncom/search-guard-ssl/blob/es-5.5.2/example-pki-scripts/gen\_node\_cert\_openssl.sh](https://github.com/floragunncom/search-guard-ssl/blob/es-5.5.2/example-pki-scripts/gen_node_cert_openssl.sh))
> > 
> > I then added the admin keystore to the node keystore to have one unique keystore.
> > 
> > keytool -list -storetype pkcs12 -keystore /etc/elasticsearch/node1/keystore\_es.p12
> 
> > ``
> 
> > Gives :
> > 
> > Keystore type: PKCS12  
> > Keystore provider: SunJSSE
> > 
> > Your keystore contains 2 entries
> > 
> > 1, Aug 31, 2017, PrivateKeyEntry,  
> > Certificate fingerprint (SHA1): CF:A1:E2:C1:35:85:5B:A5:49:7B:E1:8B:9F:6A:65:C7:45:39:3A:3C  
> > admin, Aug 31, 2017, PrivateKeyEntry,  
> > Certificate fingerprint (SHA1): BE:35:51:43:65:AB:B9:A0:8D:2C:C7:6A:B8:DB:29:A5:8F:07:B2:E9
> 
> > ``
> 
> > I checked the searchguard.authcz.admin\_dn configuration.
> > 
> > However, when I run  
> > sh tools/sgadmin.sh -icl -nhnv -ks /etc/elasticsearch/node1/keystore\_es.p12 -ksalias admin -ts /etc/elasticsearch/node1/truststore\_es.jks
> 
> > ``
> 
> > Output :
> > 
> > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate …  
> > Clustername: elasticsearch  
> > Clusterstate: GREEN  
> > Number of nodes: 4  
> > Number of data nodes: 3
> 
> > ``
> 
> > and at the same time, in the elasticsearch log file :  
> > [2017-08-31T16:48:11,078][ERROR][c.f.s.c.ConfigurationLoader] Failure no such index retrieving configuration for [roles] (index=searchguard)
> 
> > ``
> 
> > and after a minute in the stdout :  
> > ERR: An unexpected ElasticsearchSecurityException occured: Search Guard not initialized (SG11) for indices:admin/exists. See https://[github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md](http://github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md)  
> > Trace:  
> > ElasticsearchSecurityException[Search Guard not initialized (SG11) for indices:admin/exists. See https://[github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md](http://github.com/floragunncom/search-guard-docs/blob/master/sgadmin.md)]  
> > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:128)  
> > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168)  
> > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142)  
> > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64)  
> > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54)  
> > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:178)  
> > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:192)  
> > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:140)  
> > at com.floragunn.searchguard.SearchGuardPlugin$3$1.messageReceived(SearchGuardPlugin.java:376)  
> > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69)  
> > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544)  
> > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37)  
> > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110)  
> > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501)  
> > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385)  
> > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
> > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310)  
> > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297)  
> > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413)  
> > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
> > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
> > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267)  
> > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078)  
> > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489)  
> > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428)  
> > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)  
> > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)  
> > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926)  
> > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134)  
> > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644)  
> > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544)  
> > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498)  
> > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458)  
> > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)  
> > at java.lang.Thread.run(Thread.java:748)
> 
> > ``
> 
> > and at the same time in the elasticsearch log file :
> > 
> > [2017-08-31T16:50:49,129][ERROR][c.f.s.c.IndexBaseConfigurationRepository] Unable to load configuration because of java.util.concurrent.TimeoutException: Timeout after 1MINUTES while retrieving configuration for roles  
> > java.util.concurrent.TimeoutException: Timeout after 1MINUTES while retrieving configuration for roles  
> > at com.floragunn.searchguard.configuration.ConfigurationLoader.load(ConfigurationLoader.java:103) ~[search-guard-5-5.5.2-15.jar:?]  
> > at com.floragunn.searchguard.configuration.IndexBaseConfigurationRepository.loadConfigurations(IndexBaseConfigurationRepository.java:361) [search-guard-5-5.5.2-15.jar:?]  
> > at com.floragunn.searchguard.configuration.IndexBaseConfigurationRepository.getConfiguration(IndexBaseConfigurationRepository.java:206) [search-guard-5-5.5.2-15.jar:?]  
> > at com.floragunn.searchguard.configuration.PrivilegesEvaluator.getRolesSettings(PrivilegesEvaluator.java:173) [search-guard-5-5.5.2-15.jar:?]  
> > at com.floragunn.searchguard.configuration.PrivilegesEvaluator.isInitialized(PrivilegesEvaluator.java:185) [search-guard-5-5.5.2-15.jar:?]  
> > at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:126) [search-guard-5-5.5.2-15.jar:?]  
> > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:168) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:142) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:64) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.action.support.HandledTransportAction$TransportHandler.messageReceived(HandledTransportAction.java:54) [elasticsearch-5.5.2.jar:5.5.2]  
> > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceivedDecorate(SearchGuardSSLRequestHandler.java:178) [search-guard-ssl-5.5.2-23.jar:5.5.2-23]  
> > at com.floragunn.searchguard.transport.SearchGuardRequestHandler.messageReceivedDecorate(SearchGuardRequestHandler.java:192) [search-guard-5-5.5.2-15.jar:?]  
> > at com.floragunn.searchguard.ssl.transport.SearchGuardSSLRequestHandler.messageReceived(SearchGuardSSLRequestHandler.java:140) [search-guard-ssl-5.5.2-23.jar:5.5.2-23]  
> > at com.floragunn.searchguard.SearchGuardPlugin$3$1.messageReceived(SearchGuardPlugin.java:376) [search-guard-5-5.5.2-15.jar:?]  
> > at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:69) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.transport.TcpTransport$RequestHandler.doRun(TcpTransport.java:1544) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.common.util.concurrent.EsExecutors$1.execute(EsExecutors.java:110) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.transport.TcpTransport.handleRequest(TcpTransport.java:1501) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:1385) [elasticsearch-5.5.2.jar:5.5.2]  
> > at org.elasticsearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:74) [transport-netty4-client-5.5.2.jar:5.5.2]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:297) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:413) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1267) [netty-handler-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1078) [netty-handler-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) [netty-codec-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.11.Final.jar:4.1.11.Final]  
> > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.11.Final.jar:4.1.11.Final]  
> > at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_141]  
> > [2017-08-31T16:50:49,131][ERROR][c.f.s.f.SearchGuardFilter] Search Guard not initialized (SG11) for indices:admin/exists
> 
> > ``
> 
> > The diagnose trace :
> > 
> > Diagnostic sgadmin trace  
> > ES client version: 5.5.2  
> > Client properties: {[java.runtime.name](http://java.runtime.name)=OpenJDK Runtime Environment, sun.boot.library.path=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.el7\_3.x86\_64/jre/lib/amd64, java.vm.version=25.141-b16, jdk.tls.rejectClientInitiatedRenegotiation=true, java.vm.vendor=Oracle Corporation, java.vendor.url=[http://java.oracle.com/](http://java.oracle.com/), path.separator=:, [java.vm.name](http://java.vm.name)=OpenJDK 64-Bit Server VM, file.encoding.pkg=[sun.io](http://sun.io), user.country=US, sun.java.launcher=SUN\_STANDARD, sun.os.patch.level=unknown, [java.vm.specification.name](http://java.vm.specification.name)=Java Virtual Machine Specification, user.dir=/usr/share/elasticsearch/plugins/search-guard-5, sg.nowarn.client=true, java.runtime.version=1.8.0\_141-b16, java.awt.graphicsenv=sun.awt.X11GraphicsEnvironment, java.endorsed.dirs=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.141-1.b16.el7\_3.x86\_64/jre/lib/endorsed, os.arch=amd64, java.io.tmpdir=/tmp, line.separator=
> > 
> > Any help would be much appreciated…