# Certificate\_unknown logged upon each successful request from Chrome or Edge
**URL:** https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625
**Category:** Security
**Created:** [August 23, 2023, 4:25pm UTC](https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625 "2023-08-23T16:25:06Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@jcarnec](https://forum.opensearch.org/u/jcarnec)
#### Post date: [August 23, 2023, 4:25pm UTC](https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625/1 "2023-08-23T16:25:06Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):
2.9.0
**Describe the issue** :
When running Opensearch on docker, each time I open the Opensearch URL [https://opensearch:9200](https://opensearch:9200) from a Chrome or Edge browser, I can successfully log in, and the request returns correct results, but in the logs I see a stack trace complaining about a certificate\_unknown error.
When using Firefox, I do not get any error in the logs
**Configuration** :
To reproduce the issue: just run:
`docker run -p 9200:9200 -p 9600:9600 -e "discovery.type=single-node" opensearchproject/opensearch:2.9.0`
Then try to access the following URL from a Chrome or Edge browser: [https://opensearch:9200](https://opensearch:9200)
Login as admin/admin
Observe the stack trace below in the logs each time you refresh the web page
**Relevant Logs or Screenshots** :
Here is the full stack trace I get each time I try to access Opensearch REST API from Chrome or Edge:
```auto
[2023-08-23T16:00:15,842][ERROR][o.o.s.s.h.n.SecuritySSLNettyHttpServerTransport] [bfdcf08a011a] Exception during establishing a SSL connection: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:365) ~[?:?]
at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) ~[?:?]
at sun.security.ssl.TransportContext.dispatch(TransportContext.java:204) ~[?:?]
at sun.security.ssl.SSLTransport.decode(SSLTransport.java:172) ~[?:?]
at sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:736) ~[?:?]
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:691) ~[?:?]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:506) ~[?:?]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:482) ~[?:?]
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:679) ~[?:?]
at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:297) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1353) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1246) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1295) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[netty-codec-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[netty-codec-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[netty-codec-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) [netty-common-4.1.94.Final.jar:4.1.94.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.94.Final.jar:4.1.94.Final]
at java.lang.Thread.run(Thread.java:833) [?:?]
[2023-08-23T16:00:15,844][WARN][o.o.h.AbstractHttpServerTransport] [bfdcf08a011a] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/172.17.0.2:9200, remoteAddress=/9.171.164.180:63137}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:499) ~[netty-codec-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[netty-codec-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) [netty-transport-4.1.94.Final.jar:4.1.94.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) [netty-common-4.1.94.Final.jar:4.1.94.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.94.Final.jar:4.1.94.Final]
at java.lang.Thread.run(Thread.java:833) [?:?]
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:365) ~[?:?]
at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) ~[?:?]
at sun.security.ssl.TransportContext.dispatch(TransportContext.java:204) ~[?:?]
at sun.security.ssl.SSLTransport.decode(SSLTransport.java:172) ~[?:?]
at sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:736) ~[?:?]
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:691) ~[?:?]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:506) ~[?:?]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:482) ~[?:?]
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:679) ~[?:?]
at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:297) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1353) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1246) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1295) ~[netty-handler-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[netty-codec-4.1.94.Final.jar:4.1.94.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[netty-codec-4.1.94.Final.jar:4.1.94.Final]
... 16 more
```
---
### Author:  [@Eugene7](https://forum.opensearch.org/u/Eugene7)
#### Post date: [August 24, 2023, 2:19pm UTC](https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625/2 "2023-08-24T14:19:43Z")
Hi @jcarnec
Have you received the error each time you refresh the web page or before login as admin/admin?
Can you try to execute the following command?
```auto
curl -XGET --insecure -u 'admin:admin' 'https://opensearch:9200'
```
---
### Author:  [@Eugene7](https://forum.opensearch.org/u/Eugene7)
#### Post date: [August 24, 2023, 2:44pm UTC](https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625/3 "2023-08-24T14:44:49Z")
The observed errors are expected as the client browser is trying to contact the OpenSearch service that is running with a self-signed certificate.
The Firefox browser doesn’t cause this error as possibly this OpenSearch URL has been placed in the exceptions list in the Firefox.
---
### Author:  [@jcarnec](https://forum.opensearch.org/u/jcarnec)
#### Post date: [August 24, 2023, 3:52pm UTC](https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625/4 "2023-08-24T15:52:28Z")
Thanks Eugene7
Even if this seems to be an expected behavior, the outcome of this is that the logs are flooded with false positive stack traces.
I think these exceptions should not be logged if in **config/opensearch-security/config.yml** , the clientcert\_auth\_domain is disabled as follows:
```auto
config:
dynamic:
authc:
clientcert_auth_domain:
description: "Authenticate via SSL client certificates"
http_enabled: false
transport_enabled: false
```
---
### Author:  [@Eugene7](https://forum.opensearch.org/u/Eugene7)
#### Post date: [August 25, 2023, 1:23pm UTC](https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625/5 "2023-08-25T13:23:29Z")
Hi @jcarnec
According to the documentation [here](https://opensearch.org/docs/latest/security/authentication-backends/client-auth/), the clientcert\_auth\_domain is used for client certificate authentication (mTLS).
In your case, you use basic authentication with SSL encryption. SSL encryption use certificates in order to encrypt communication between a client (browser) and a service (OpenSearch).
You received this exception because the OpenSearch service records the client-service handshake communication.
This is useful in case you have issues with certificate validation. To stop these messages you either should use signed certificates or add OpenSearch’s root CA to the OS’s keystore.
---
### Author:  [@jcarnec](https://forum.opensearch.org/u/jcarnec)
#### Post date: [August 25, 2023, 1:54pm UTC](https://forum.opensearch.org/t/certificate-unknown-logged-upon-each-successful-request-from-chrome-or-edge/15625/6 "2023-08-25T13:54:47Z")
Thanks Eugene7,
The SSL encryption of the communication between the client and Opensearch should only rely on the certificate exposed by Opensearch. As I am using self signed certificates, my browser first complained about it and asked my if I wanted to trust the self signed certificate. Of course I accepted it, and therefore I don’t see any reason why the logs still complain about certificate\_unknown.
I am clearly missing some understanding of what Opensearch is doing upon incoming queries.