# Error communicating with remote model - SSL handshake exception **URL:** \ **Category:** Machine Learning\ **Tags:** configure\ **Created:** [October 26, 2025, 1:16pm UTC](https://forum.opensearch.org/t/error-communicating-with-remote-model-ssl-handshake-exception/27368 "2025-10-26T13:16:30Z")\ **Posts on this page:** 1\ **Showing post:** 8
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [November 3, 2025, 1:40pm UTC](https://forum.opensearch.org/t/error-communicating-with-remote-model-ssl-handshake-exception/27368/8 "2025-11-03T13:40:16Z")
@muneer This workaround was mentioned today by one of the users. > [@Add Custom CA for internal HTTPS endpoints](https://forum.opensearch.org/t/add-custom-ca-for-internal-https-endpoints/27417): > > Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.3.0 Describe the issue: I am trying to connect my local (docker) OpenSearch Cluster to an LLM that can only be accessed through our internal OpenRouter installation, that is secured by our internal CA. I am unable to provide the CA to OpenSearch for outgoing HTTPS connections. I end up having: Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException… > [@What CA is used by notifications channels?](https://forum.opensearch.org/t/what-ca-is-used-by-notifications-channels/11451/4): > > SOLVED Solved the issue after a good deal of trial and error. The notification channels outgoing httpclient uses the Java Runtime trust store, and NOT the opensearch truststore for verifying connections. This is important, as it means you will have to trust your CA with Javas cacerts truststore as well. This can be done by: Access your container as root, in order to have sufficient privileges: docker exec -u root -it opensearch\_container\_name bash Read your existing truststore and veri… I have followed the steps and successfully connected to my Ollama with HTTPS. I’ve shared my steps in the other thread. I understand that this is a workaround, and the ML plugin should contain an option for self-signed certificates > [@Add Custom CA for internal HTTPS endpoints](https://forum.opensearch.org/t/add-custom-ca-for-internal-https-endpoints/27417/2): > > @FalcoSuessgott I’ve tested solution provided in the shared link and I was able to connect to my remote Ollama with HTTPS and self-signed certificate. These were my steps. Copy cacerts keystore from the running OpenSearch Docker docker cp opensearch-node1\_3.3.0:/usr/share/opensearch/jdk/lib/security/cacerts . Get certificate from Ollama instance openssl s\_client -connect ollama.pablo.local:443 Save certificate into ollama.crt Add ollama.crt to the carets keystore keytool -import -nopro… --- _[View the full topic](https://forum.opensearch.org/t/error-communicating-with-remote-model-ssl-handshake-exception/27368)._