# Certificate configuration Error **URL:** \ **Category:** Security\ **Tags:** troubleshoot, configure\ **Created:** [June 15, 2023, 3:35pm UTC](https://forum.opensearch.org/t/certificate-configuration-error/14714 "2023-06-15T15:35:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Spagedicode](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@Spagedicode](https://forum.opensearch.org/u/Spagedicode)\ **Post date:** [June 15, 2023, 3:35pm UTC](https://forum.opensearch.org/t/certificate-configuration-error/14714/1 "2023-06-15T15:35:31Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): I am running opensearch 2.5.0 on Ubuntu 20.04.5 LTS. I tested my installation and everything worked fine when using self signed certificates. **Describe the issue** : In order for other members of my organisation to access the opensearch server the node certificate has to be signed by our root CA as well as the admin certificate. I do not have access to the root CA .pem file. I have the node and admin .pem files, which contain the entire certificate chain e.g.: # common name –BEGIN CERT— –END CERT— –BEGIN CERT— –END CERT— –BEGIN CERT— –END CERT— I picked the last cert and set it as ```auto plugins.security.ssl.transport.pemtrustedcas_filepath ``` but now I get this error when running securityadmin.sh I can’t seam to resolve: Caused by: sun.security.validator.ValidatorException: Extended key usage does not permit use for TLS client authentication I think that error is quite evident but since I am not the CA I can’t just put TLS client auth onto the root certificate. **Configuration** : opensearch.yml: plugins.security.ssl.transport.pemcert\_filepath: node1.pem plugins.security.ssl.transport.pemkey\_filepath: node1-key.pem plugins.security.ssl.transport.pemtrustedcas\_filepath: \.pem securitiyadmin commnad: ./securityadmin.sh -cd /etc/opensearch/opensearch-security/ -cacert /etc/opensearch/\.pem -cert /etc/opensearch/opensearch\_admin.pem -key /etc/opensearch/admin-key.pem -icl -nhnv ---
**Author:** ![Gsmitt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/gsmitt/32/1718_2.png) [@Gsmitt](https://forum.opensearch.org/u/Gsmitt)\ **Post date:** [June 15, 2023, 11:40pm UTC](https://forum.opensearch.org/t/certificate-configuration-error/14714/2 "2023-06-15T23:40:38Z")
Hey @Spagedicode > [@Spagedicode](#): > > Caused by: sun.security.validator.ValidatorException: Extended key usage does not permit use for TLS client authentication your certificate must either be marked as having both clientAuth and serverAuth extended key usage, or not have that extension included at all. Your CA has made the choice to fill in the extended key usage extension with “serverAuth”, they can either put both “serverAuth” and “clientAuth” in there, or take the simpler option and not fill in that extension at all. ---
**Author:** ![Spagedicode](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@Spagedicode](https://forum.opensearch.org/u/Spagedicode)\ **Post date:** [June 19, 2023, 8:12am UTC](https://forum.opensearch.org/t/certificate-configuration-error/14714/3 "2023-06-19T08:12:41Z")
Hey @Gsmitt, I am not sure I quite understand which certificate you are referring to. Here is some more information. \*\*Root cert X509v3 extensions: \*\* ```auto X509v3 extensions: X509v3 Key Usage: Digital Signature, Certificate Sign, CRL Sign X509v3 Basic Constraints: critical CA:TRUE X509v3 Subject Key Identifier: foo:bar:foo:bar:foo:bar X509v3 Certificate Policies: Policy: 2.16.840.1.113995.2.1.1 CPS: https://.... ``` \*\*Admin cert X509v3 extensions: \*\* ```auto X509v3 extensions: X509v3 Key Usage: Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication ``` \*\*Node cert X509v3 extensions: \*\* ```auto X509v3 extensions: X509v3 Key Usage: Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication 1.3.6.1.4.1 ``` I ommited some of the extensions since I did not deem them important, but I left something important out please tell me and I will add it. ---
**Author:** ![Gsmitt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/gsmitt/32/1718_2.png) [@Gsmitt](https://forum.opensearch.org/u/Gsmitt)\ **Post date:** [June 19, 2023, 9:27pm UTC](https://forum.opensearch.org/t/certificate-configuration-error/14714/4 "2023-06-19T21:27:45Z")
Hey @Spagedicode Your node cert… > [@Spagedicode](#): > > `TLS Web Client Authentication,` This might be why Opensearch is complaining. As for fixing it, i really dont know but this demo [here](https://opensearch.org/docs/latest/install-and-configure/install-opensearch/debian/#configure-tls) helped me out on what I needed. As for **securityadmin.sh** this is what I did. Using **-h** help resolve some issues I had ```auto ./securityadmin.sh -h opensearch.domain.com -cd /etc/opensearch/opensearch-security/ -cacert /etc/opensearch/root-ca.pem -cert /etc/opensearch/admin.pem -key /etc/opensearch/admin-key.pem -icl -nhnv ``` ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [June 20, 2023, 1:22pm UTC](https://forum.opensearch.org/t/certificate-configuration-error/14714/5 "2023-06-20T13:22:26Z")
Hi @Spagedicode! Only the Node Certificates need both: `clientAuth` and ` serverAuth`. (So, based on the latest details you’ve shared, your Nodes Certs should be OK.) However, the Admin Certificate should be a Client Certificate - therefore, it needs `clientAuth`, but currently has `serverAuth`. Pease try by using a Client-Cert for your Admin Certificate. ---
**Author:** ![Spagedicode](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@Spagedicode](https://forum.opensearch.org/u/Spagedicode)\ **Post date:** [June 26, 2023, 8:19am UTC](https://forum.opensearch.org/t/certificate-configuration-error/14714/6 "2023-06-26T08:19:58Z")
Thank you everyone, I was able to resolve it just like you told me. Now both my node and client certificate have the following extended key usage. X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication