# Opensearch certificate **URL:** \ **Category:** Security\ **Created:** [April 7, 2023, 5:59am UTC](https://forum.opensearch.org/t/opensearch-certificate/13833 "2023-04-07T05:59:18Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Keo](https://avatars.discourse-cdn.com/v4/letter/k/dbc845/32.png) [@Keo](https://forum.opensearch.org/u/Keo)\ **Post date:** [April 7, 2023, 5:59am UTC](https://forum.opensearch.org/t/opensearch-certificate/13833/1 "2023-04-07T05:59:18Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): **Describe the issue** : Hello community, I am trying to configure OpenSearch with LDAPS. I have exported the certificate from the Active Directory and then converted it to PEM using the command `openssl x509 -inform DER -in ldaps_cert.cer -out ldaps_cert.pem` . Afterwards, I added it to the `opensearch.yml` file as shown in the configuration below: **Configuration** : ## ash-4.2# cat opensearch.yml cluster.name: docker-cluster # Bind to all interfaces because we don’t know what IP address Docker will assign to us. network.host: 0.0.0.0 # # minimum\_master\_nodes need to be explicitly set when bound on a public IP # # set to 1 to allow single node clusters # discovery.zen.minimum\_master\_nodes: 1 # Setting network.host to a non-loopback address enables the annoying bootstrap checks. “Single-node” mode disables them again. # discovery.type: single-node ######## Start OpenSearch Security Demo Configuration ######## # WARNING: revise all the lines below before you go into production plugins.security.ssl.transport.pemcert\_filepath: esnode.pem plugins.security.ssl.transport.pemkey\_filepath: esnode-key.pem plugins.security.ssl.transport.pemtrustedcas\_filepath: ldap\_cert.pem plugins.security.ssl.transport.enforce\_hostname\_verification: false plugins.security.ssl.http.enabled: true plugins.security.ssl.http.pemcert\_filepath:esnode.pem plugins.security.ssl.http.pemkey\_filepath: esnode-key.pem plugins.security.ssl.http.pemtrustedcas\_filepath: root-ca.pem plugins.security.allow\_unsafe\_democertificates: true plugins.security.allow\_default\_init\_securityindex: true plugins.security.authcz.admin\_dn: - CN=kirk,OU=client,O=client,L=test, C=de - CN=dc\_name-WIN-DC-CA,DC=dc\_name,DC=lab plugins.security.audit.type: internal\_opensearch plugins.security.enable\_snapshot\_restore\_privilege: true plugins.security.check\_snapshot\_restore\_write\_privileges: true plugins.security.restapi.roles\_enabled: [“all\_access”, “security\_rest\_api\_access”] plugins.security.system\_indices.enabled: true plugins.security.system\_indices.indices: [“.plugins-ml-model”, “.plugins-ml-task”, “.opendistro-alerting-config”, “.opendistro-alerting-alert\*”, “.opendistro-anomaly-results\*”, “.opendistro-anomaly-detector\*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-_", ".opensearch-notifications-_”, “.opensearch-notebooks”, “.opensearch-observability”, “.opendistro-asynchronous-search-response\*”, “.replication-metadata-store”] node.max\_local\_storage\_nodes: 3 ######## End OpenSearch Security Demo Configuration ######## **Relevant Logs or Screenshots** : bash-4.2# “/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh” -f “/usr/share/opensearch/config/opensearch-security/config.yml” -icl -key “/usr/share/opensearch/config/kirk-key.pem” -cert “/usr/share/opensearch/config/ldap\_cert.pem” -cacert “/usr/share/opensearch/config/root-ca.pem” -nhnv * * * \*\* This tool will be deprecated in the next major release of OpenSearch \*\* \*\* [[DEPRECATION] Security Plugin Tools will be replaced · Issue #1755 · opensearch-project/security · GitHub](https://github.com/opensearch-project/security/issues/1755) \*\* * * * Security Admin v7 Will connect to localhost:9200 … done ERR: An unexpected SSLHandshakeException occured: Received fatal alert: certificate\_unknown See [Java high-level REST client - OpenSearch Documentation](https://opensearch.org/docs/latest/clients/java-rest-high-level/) for troubleshooting. Trace: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate\_unknown See [Java high-level REST client - OpenSearch Documentation](https://opensearch.org/docs/latest/clients/java-rest-high-level/) for troubleshooting. at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:947) at org.opensearch.client.RestClient.performRequest(RestClient.java:332) at org.opensearch.client.RestClient.performRequest(RestClient.java:320) at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:462) at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:159) Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate\_unknown at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117) at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:358) at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:204) at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172) at java.base/sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:736) at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:691) at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:506) at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:482) at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:679) at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:278) at org.apache.http.nio.reactor.ssl.SSLIOSession.decryptData(SSLIOSession.java:507) at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:550) at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120) at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162) at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337) at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315) at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276) at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104) at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:591) at java.base/java.lang.Thread.run(Thread.java:833) ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [May 23, 2023, 10:55am UTC](https://forum.opensearch.org/t/opensearch-certificate/13833/2 "2023-05-23T10:55:14Z")
@Keo Could you confirm if this case is related to [Unable to connect to ldapserver due to OpenSearchException[Empty file path for plugins.security.ssl.transport.truststore\_filepath]. Try next](https://forum.opensearch.org/t/unable-to-connect-to-ldapserver-due-to-opensearchexception-empty-file-path-for-plugins-security-ssl-transport-truststore-filepath-try-next/13848) and [ERR: An unexpected SSLHandshakeException occured: PKIX path building failed:](https://forum.opensearch.org/t/err-an-unexpected-sslhandshakeexception-occured-pkix-path-building-failed/13840)? Is this reported issue solved?