# Configure remote search with differing CAs

**URL:** <https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076>\
**Category:** Security\
**Created:** [April 21, 2023, 7:43pm UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076 "2023-04-21T19:43:45Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![retorpigs](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@retorpigs](https://forum.opensearch.org/u/retorpigs)\
**Post date:** [April 21, 2023, 7:43pm UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/1 "2023-04-21T19:43:45Z")

</div>

I’m trying to set up remote search between multiple clusters. The problem I’m running into is that the clusters have different CAs that issued their node certificates, and therefore, the clusters can’t talk to each other using transport on port 9300. Is there a solution to this?

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [April 24, 2023, 1:17pm UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/2 "2023-04-24T13:17:48Z")

</div>

Hi @retorpigs

Do your files, which are defined in the parameters below, contain RootCAs from both clusters?

plugins.security.ssl.transport.pemtrustedcas\_filepath  
plugins.security.ssl.http.pemtrustedcas\_filepath

---

<div class="post-metadata">

**Author:** ![retorpigs](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@retorpigs](https://forum.opensearch.org/u/retorpigs)\
**Post date:** [April 24, 2023, 2:51pm UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/3 "2023-04-24T14:51:29Z")

</div>

@Eugene7 I tried adding both certs to one file, but that didn’t seem to work. Can I somehow add both files?

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [April 25, 2023, 9:42am UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/4 "2023-04-25T09:42:47Z")

</div>

Have you used the format, which I put below, in that root certificate file?

```auto
-----BEGIN CERTIFICATE-----
<local RootCA certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<remote RootCA certificate>
-----END CERTIFICATE-----

```

Did you have the same files and configuration, which I mentioned before, for both clusters?

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [April 25, 2023, 9:44am UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/5 "2023-04-25T09:44:34Z")

</div>

Also, please try to test the connection from the ES node using the curl command and the certificates of the remote certificate:

```auto
curl --insecure --cert <node_cert> --key <node_key> -XGET https://<remote_OpenSearch_node>:9200 

```

---

<div class="post-metadata">

**Author:** ![retorpigs](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@retorpigs](https://forum.opensearch.org/u/retorpigs)\
**Post date:** [April 25, 2023, 2:29pm UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/6 "2023-04-25T14:29:08Z")

</div>

I did use that format for the root cert, and it didn’t work. when I copy the esnode cert/key, and the root CA from the remote cluster, everything works fine.  
I even tried using a keystore and truststore, and put both CA in the trust store, but that didn’t work either.

---

<div class="post-metadata">

**Author:** ![retorpigs](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@retorpigs](https://forum.opensearch.org/u/retorpigs)\
**Post date:** [April 25, 2023, 2:33pm UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/7 "2023-04-25T14:33:51Z")

</div>

Okay, im realizing now that when I put the other root ca back to back in the root-ca.pem file, the java error changes from “unable to find valid certification path to requested target” to “Received fatal alert: bad\_certificate”

---

<div class="post-metadata">

**Author:** ![retorpigs](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@retorpigs](https://forum.opensearch.org/u/retorpigs)\
**Post date:** [April 25, 2023, 3:35pm UTC](https://forum.opensearch.org/t/configure-remote-search-with-differing-cas/14076/8 "2023-04-25T15:35:17Z")

</div>

Okay, solved. I didnt realize that the remote cluster had to have the root CA of the coordinating cluster as well.  
For anyone else running into problems, this thread helped: [Cross cluster search between two clusters not working](https://forum.opensearch.org/t/cross-cluster-search-between-two-clusters-not-working/8548)