# Opensearch security plugin with certificate chain **URL:** \ **Category:** Security\ **Created:** [March 10, 2023, 5:05pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066 "2023-03-10T17:05:16Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![enricof](https://avatars.discourse-cdn.com/v4/letter/e/45deac/32.png) [@enricof](https://forum.opensearch.org/u/enricof)\ **Post date:** [March 10, 2023, 5:05pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/1 "2023-03-10T17:05:16Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.5.0 **Describe the issue** : I would like to configure the security plugin with a certificate chain, so that the CA certificate is composed by intermediate CA + root CA. If I put the entire chain (node certificate + intermediate CA + root CA) as value of plugins.security.ssl.transport.pemcert\_filepath and plugins.security.ssl.http.pemcert\_filepath the service starts, but the securityadmin.sh returns this message: Security Admin v7 Will connect to HOSTNAME:9200 … done ERR: An unexpected SSLHandshakeException occured: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target See [Java high-level REST client - OpenSearch documentation](https://opensearch.org/docs/latest/clients/java-rest-high-level/) for troubleshooting. Trace: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target See [Java high-level REST client - OpenSearch documentation](https://opensearch.org/docs/latest/clients/java-rest-high-level/) for troubleshooting. at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:947) at org.opensearch.client.RestClient.performRequest(RestClient.java:332) at org.opensearch.client.RestClient.performRequest(RestClient.java:320) at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:462) at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:159) Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Do you have any idea how to solve this issue? Thanks. **Configuration** : plugins.security.disabled: false plugins.security.ssl.transport.pemcert\_filepath: /etc/opensearch/puppetcerts/chain.pem plugins.security.ssl.transport.pemkey\_filepath: /etc/opensearch/puppetcerts/node-key.pem plugins.security.ssl.transport.pemtrustedcas\_filepath: /etc/opensearch/puppetcerts/ca.pem plugins.security.ssl.http.pemcert\_filepath: /etc/opensearch/puppetcerts/chain.pem plugins.security.ssl.http.pemkey\_filepath: /etc/opensearch/puppetcerts/node-key.pem plugins.security.ssl.http.pemtrustedcas\_filepath: /etc/opensearch/puppetcerts/ca.pem plugins.security.ssl.transport.enforce\_hostname\_verification: false plugins.security.ssl.http.enabled: true plugins.security.allow\_unsafe\_democertificates: true plugins.security.allow\_default\_init\_securityindex: true plugins.security.authcz.admin\_dn: - /C=de/L=test/O=client/OU=client/CN=kirk **Relevant Logs or Screenshots** : ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [March 10, 2023, 5:28pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/2 "2023-03-10T17:28:32Z")
@enricof `plugins.security.ssl.http.pemcert_filepath` should contain only intermediate CA + root CA. Please be aware that the admin certificate should be signed by the same Intermediate/RootCA as the node cert. If they’re different then you need to add the admin’s RootCA to that chain.pem file too. ```auto -----BEGIN CERTIFICATE----- < intermediate CA cert> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- ``` ---
**Author:** ![enricof](https://avatars.discourse-cdn.com/v4/letter/e/45deac/32.png) [@enricof](https://forum.opensearch.org/u/enricof)\ **Post date:** [March 10, 2023, 9:18pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/3 "2023-03-10T21:18:39Z")
Hi Pablo thanks for the fast response. Do you mean I should remove the node certificate from che chain.pem file and put this chain.pem as value for plugins.security.ssl.http.pemcert\_filepath and also for plugins.security.ssl.transport.pemcert\_filepath ? And what about plugins.security.ssl.transport.pemtrustedcas\_filepath and plugins.security.ssl.http.pemtrustedcas\_filepath? Should they contain only the root CA? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [March 11, 2023, 12:36am UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/4 "2023-03-11T00:36:24Z")
@enricof Just noticed, I should write `plugins.security.ssl.http.pemtrustedcas_filepath`. In short: - `plugins.security.ssl.http.pemtrustedcas_filepath`- Intermediate/RootCA - `plugins.security.ssl.transport.pemtrustedcas_filepath`- Intermediate/RootCA - `plugins.security.ssl.http.pemcert_filepath` - only node certificate - `plugins.security.ssl.transport.pemcert_filepath` - only node certificate ---
**Author:** ![enricof](https://avatars.discourse-cdn.com/v4/letter/e/45deac/32.png) [@enricof](https://forum.opensearch.org/u/enricof)\ **Post date:** [March 11, 2023, 9:00am UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/5 "2023-03-11T09:00:16Z")
Hi Pablo, it works with an admin cert signed by the same Intermediate/RootCA as the node cert. It does not work if the admin cert is signed by a different CA, even if I add the admin cert CA to the .pem file as value of \*.pemtrustedcas\_filepath as you suggested, such as: ```auto -----BEGIN CERTIFICATE----- < node intermediate CA cert> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- < node Root CA cert > -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- < admin Root CA cert> -----END CERTIFICATE----- ``` I tried also the reverse order with no success. Do you have any idea? Thanks for your help. ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [March 13, 2023, 3:42pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/6 "2023-03-13T15:42:55Z")
@enricof Does your admin certificate chain has intermediate and RootCA certificates? ---
**Author:** ![enricof](https://avatars.discourse-cdn.com/v4/letter/e/45deac/32.png) [@enricof](https://forum.opensearch.org/u/enricof)\ **Post date:** [March 13, 2023, 4:21pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/7 "2023-03-13T16:21:13Z")
Hi, I’ve tried with the default kirk admin certificate. CA certificate is simple. Enrico ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [March 13, 2023, 4:44pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/8 "2023-03-13T16:44:27Z")
@enricof Did you try with just rootCAs in `pemtrustedcas` and intermediate with node cert in both `plugins.security.ssl.transport.pemcert_filepath` and `plugins.security.ssl.http.pemcert_filepath`? pemtrustedcas ```auto -----BEGIN CERTIFICATE----- < node Root CA cert > -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- < admin Root CA cert> -----END CERTIFICATE----- ``` pemcert ```auto -----BEGIN CERTIFICATE----- < node cert > -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- < node intermediate CA cert > -----END CERTIFICATE----- ``` ---
**Author:** ![enricof](https://avatars.discourse-cdn.com/v4/letter/e/45deac/32.png) [@enricof](https://forum.opensearch.org/u/enricof)\ **Post date:** [March 15, 2023, 3:15pm UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/9 "2023-03-15T15:15:48Z")
Hi Pablo, I’ve tried but I have the same error: ERR: An unexpected SSLHandshakeException occured: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Enrico ---
**Author:** ![idan17](https://avatars.discourse-cdn.com/v4/letter/i/ccd318/32.png) [@idan17](https://forum.opensearch.org/u/idan17)\ **Post date:** [January 24, 2024, 11:24am UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/10 "2024-01-24T11:24:48Z")
hello, have you ever managed to solve the problem @enricof ? because i happened to encounter the exact same problem and with the same configuration 😅 ---
**Author:** ![technopunk](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@technopunk](https://forum.opensearch.org/u/technopunk)\ **Post date:** [June 12, 2024, 2:04am UTC](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/11 "2024-06-12T02:04:09Z")
I too encountered this problem. I have one CA for the REST / transport layer certificates (trusted by browsers) and another self-signed CA for the admin certificate. Pablo’s comment helped guide me in the right direction: [https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/8](https://forum.opensearch.org/t/opensearch-security-plugin-with-certificate-chain/13066/8) I configured pemtrustedcas as a concatenation of my two root CA certificates. I configured pemcert as the node cert concatenated with all intermediate certificates except the root CA certificate. I used the same pemtrustedcas and pemcert file for the REST and transport layer. **What worked for me was to run the securityadmin.sh script with a -cacert file argument using the same file as pemtrustedcas (a concatenation of the two different root CA certificates).** I hope this helps someone struggle less than I did 😃