# Demo Certificates Found Error while starting ElasticSearch

**URL:** <https://forum.opensearch.org/t/demo-certificates-found-error-while-starting-elasticsearch/2780>\
**Category:** Open Source Elasticsearch and Kibana\
**Created:** [May 13, 2020, 1:06pm UTC](https://forum.opensearch.org/t/demo-certificates-found-error-while-starting-elasticsearch/2780 "2020-05-13T13:06:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saravana37](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@Saravana37](https://forum.opensearch.org/u/Saravana37)\
**Post date:** [May 13, 2020, 1:06pm UTC](https://forum.opensearch.org/t/demo-certificates-found-error-while-starting-elasticsearch/2780/1 "2020-05-13T13:06:37Z")

</div>

Hello All ,

I am trying to install my self signed certificates in Open distro for Elastic search and I see the below error when i am trying to start my elasticsearch . Please help me and i am stuck with this issue for past 2 day.Error shown below.

```
uncaught exception in thread [main]
java.lang.IllegalStateException: failed to load plugin class [com.amazon.opendistroforelasticsearch.security.OpenDistroSecurityPlugin]
Likely root cause: java.lang.RuntimeException: Demo certificates found [d14aefe70a592d7a29e14f3ff89c3d0070c99e87d21776aa07d333ee877e758f, 54a70016e0837a2b0c5658d1032d7ca32e432c62c55f01a2bf5adcb69a0a7ba9, bdc141ab2272c779d0f242b79063152c49e1b06a2af05e0fd90d505f2b44d5f5, 3e839e2b059036a99ee4f742814995f2fb0ced7e9d68a47851f43a3c630b5324, 9b13661c073d864c28ad7b13eda67dcb6cbc2f04d116adc7c817c20b4c7ed361]
        at com.amazon.opendistroforelasticsearch.security.OpenDistroSecurityPlugin.<init>(OpenDistroSecurityPlugin.java:359)
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605)
        at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556)
        at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471)
        at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163)
        at org.elasticsearch.node.Node.<init>(Node.java:313)
        at org.elasticsearch.node.Node.<init>(Node.java:257)
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221)
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221)
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349)
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170)
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161)
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125)
        at org.elasticsearch.cli.Command.main(Command.java:90)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126)
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92)
For complete error details, refer to the log at G:\ESearch_OD_Log\S1220001230A.log

```

My elasticsearch.yml

```
#action.destructive_requires_name: true
opendistro_security.ssl.transport.pemcert_filepath: node.pem
opendistro_security.ssl.transport.pemkey_filepath: node-key.pem
opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
opendistro_security.ssl.transport.enforce_hostname_verification: false
opendistro_security.ssl.http.enabled: true
opendistro_security.ssl.http.pemcert_filepath: node.pem
opendistro_security.ssl.http.pemkey_filepath: node-key.pem
opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem
opendistro_security.allow_unsafe_democertificates: false
opendistro_security.allow_default_init_securityindex: true
opendistro_security.authcz.admin_dn:
  - CN=admin,O=LONUS,L=NewYork, C=US
opendistro_security.nodes_dn:
  - CN=elasticsearch,O=LON,L=London,C=DE
  - CN=kibana,O=LON,L=London,C=DE
  - CN=<My hostname>
  - /CN=.*regex/
opendistro_security.audit.type: internal_elasticsearch
opendistro_security.enable_snapshot_restore_privilege: true
opendistro_security.check_snapshot_restore_write_privileges: true
opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
cluster.routing.allocation.disk.threshold_enabled: false
node.max_local_storage_nodes: 3

```

Things i tried to fix the same are

1. Removed the line "opendistro\_security.allow\_unsafe\_democertificates: true " or setting the line to false “opendistro\_security.allow\_unsafe\_democertificates: false”
2. Moving the demo certificates to a seperate folder.

None of the solutions worked . Kindly let me know if i am doing anything wrong and i followed the link “[SSL authentication certificates - #3 by llauber](https://forum.opensearch.org/t/ssl-authentication-certificates/2226/3)” for generating the certificates.

---

<div class="post-metadata">

**Author:** ![llauber](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@llauber](https://forum.opensearch.org/u/llauber)\
**Post date:** [May 14, 2020, 7:16am UTC](https://forum.opensearch.org/t/demo-certificates-found-error-while-starting-elasticsearch/2780/2 "2020-05-14T07:16:45Z")

</div>

Hello,

I used this script to generate the certificates:

#!/bin/bash

echo “\*\*\*\*\*\*\*\*\*\*”

echo “\* Root CA”

openssl genrsa -out root-ca-key.pem 2048"

openssl req -days 3650 -new -x509 -sha256 -key root-ca-key.pem -out root-ca.pem -subj “/C=DE/L=Berlin/O=Company/CN=root-ca”’

echo “\*\*\*\*\*\*\*\*\*\*”

echo “\* Admin cert”

echo “create: admin-key-temp.pem”

openssl genrsa -out admin-key-temp.pem 2048

echo “create: admin-key.pem”

openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem

echo “create: admin.csr”

openssl req -days 3650 -new -key admin-key.pem -out admin.csr -subj “/C=US/L=NewYork/O=CompanyUS/CN=admin”

echo “create: admin.pem”

openssl x509 -req -days 3650 -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem

echo “\*\*\*\*\*\*\*\*\*\*”

echo “\* Node cert”

echo “create: node-key-temp.pem”

openssl genrsa -out node-key-temp.pem 2048

echo “create: node-key.pem”

openssl pkcs8 -inform PEM -outform PEM -in node-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out node-key.pem

echo “create: node.csr”

openssl req -days 3650 -new -key node-key.pem -out node.csr -subj “/C=DE/L=Berlin/O=Company/CN=\*.elasticsearch”

echo “create: node.pem”

openssl x509 -req -days 3650 -in node.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out node.pem

echo “\*\*\*\*\*\*\*\*\*\*”

echo “\* Kibana cert”

echo “create: kibana-key-temp.pem”

openssl genrsa -out kibana-key-temp.pem 2048

echo “create: kibana-key.pem”

openssl pkcs8 -inform PEM -outform PEM -in kibana-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out kibana-key.pem

echo “create: kibana.csr”

openssl req -days 3650 -new -key kibana-key.pem -out kibana.csr -subj “/C=DE/L=Berlin/O=Company/CN=kibana”

echo “create: kibana.pem”

openssl x509 -req -days 3650 -in kibana.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out kibana.pem

echo “\*\*\* Ende \*\*\*”

And here is my Elasticsearch.yml:

cluster.name: “k8s-logs”

network.host: 0.0.0.0

path.repo: [“/var/nfs”]

opendistro\_security.ssl.transport.pemcert\_filepath: node.pem

opendistro\_security.ssl.transport.pemkey\_filepath: node-key.pem

opendistro\_security.ssl.transport.pemtrustedcas\_filepath: root-ca.pem

opendistro\_security.ssl.transport.enforce\_hostname\_verification: false

opendistro\_security.ssl.http.enabled: true

```
opendistro_security.ssl.http.pemcert_filepath: node.pem

```

opendistro\_security.ssl.http.pemkey\_filepath: node-key.pem

```
opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem

```

#opendistro\_security.allow\_unsafe\_democertificates: true

opendistro\_security.allow\_default\_init\_securityindex: true

opendistro\_security.authcz.admin\_dn:

- ‘CN=admin,O=CompanyUS,L=NewYork,C=US’

opendistro\_security.nodes\_dn:

- ‘CN=\*.elasticsearch,O=Company,L=Berlin,C=DE’

- ‘CN=kibana,O=Company,L=Berlin,C=DE’

- ‘CN=\*,O=Company,L=Berlin,C=DE’

- ‘CN=k8s-logs\*’

- ‘/CN=.\*regex/’

opendistro\_security.audit.type: internal\_elasticsearch

opendistro\_security.enable\_snapshot\_restore\_privilege: true

opendistro\_security.check\_snapshot\_restore\_write\_privileges: true

opendistro\_security.restapi.roles\_enabled: [“all\_access”, “security\_rest\_api\_access”]

cluster.routing.allocation.disk.threshold\_enabled: false

node.max\_local\_storage\_nodes: 3

I used this in a Kubernetes Environment. The Elasticsearch nodes are running as Statefulset.

See [  
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-elasticsearch-fluentd-and-kibana-efk-logging-stack-on-kubernetes](https://www.digitalocean.com/community/tutorials/how-to-set-up-an-elasticsearch-fluentd-and-kibana-efk-logging-stack-on-kubernetes)

For test environments you can use the demo certificates (already included in the docker image).

Btw: OpenIDconnect is sill not working.

Best regards

Lorenz

---

<div class="post-metadata">

**Author:** ![llauber](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@llauber](https://forum.opensearch.org/u/llauber)\
**Post date:** [May 14, 2020, 7:33am UTC](https://forum.opensearch.org/t/demo-certificates-found-error-while-starting-elasticsearch/2780/3 "2020-05-14T07:33:31Z")

</div>

Hello,

maybe your CN in your certificates is different from the hostname you used for the Elasticsearch node.

In elasticsearch.yml I used this syntax:

CN=\*.elasticsearch

The intention was: my Elasticsearch nodes have the hostnames es-cluster-0.elasticsearch, es-cluster-1.elasticsearch and so on.

Best regards

Lorenz

---

<div class="post-metadata">

**Author:** ![Saravana37](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@Saravana37](https://forum.opensearch.org/u/Saravana37)\
**Post date:** [May 14, 2020, 8:15am UTC](https://forum.opensearch.org/t/demo-certificates-found-error-while-starting-elasticsearch/2780/4 "2020-05-14T08:15:39Z")

</div>

Thank you @llauber , I will try and let you know the outcome.