Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OS version 3.3.2, dashboard: 3.3.0 Describe the issue: While trying to connect minio (on https), following error occurs: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certific…

@yashg You could try copying /usr/share/opensearch/jdk/lib/security/cacerts from the OpenSearch binary and adding the cert with the mentioned keytool command. https://artifacts.opensearch.org/releases/bundle/opensearch/3.3.2/opensearch-3.3.2-linux-x64.tar.gz Then map it with extraVolume.

@yashg Have you tried adding Minio SSL certificate to Java’s keystore? /usr/share/opensearch/jdk/lib/security/cacerts keytool -import -noprompt -trustcacerts -alias minio -file <minio.crt> -keystore /usr/share/opensearch/jdk/lib/security/cacerts -storepass changeit

Hi @pablo , the java’s keystore is by-default read only, so I tried making a custom-truststore, adding minio’s ca cert there and then customizing the following field in helm’s values.yml: opensearchJavaOpts: “-Xmx2048M -Xms2048M -Djavax.net.ssl.trustStore=/truststore/custom-truststore.jks -Djavax.ne…

How do you deploy your cluster?

I’ve got it from your first message. So K3 with Official OS charts.

Using helm, as per the docs instructions. My hot-values.yml is: clusterName: “opensearch-cluster” nodeGroup: “hot” masterService: “opensearch-cluster-hot” replicas: 3 roles: cluster_manager ingest data opensearchJavaOpts: "-Xmx2048M -Xms2048M " resources: requests: cpu: “1000m” memory: “3Gi” …

Thanks a lot, this seems to be working… The thing I did is copy keystore to /tmp folder, add the cert, copy it back. And with the new cert, created secret and create volumeMount from that. extraVolumes: name: custom-cacerts secret: secretName: opensearch-custom-cacerts extraVolumeMounts: n…

The Only Issue I can see is the slow speed of the connection/process, which was almost instant when I connected Docker-contained OS with minio without HTTPS. Can I do something for this? Would increasing RAM to OS or to JVM work? Like when I do this: PUT _snapshot/minio-repo/snapshot-logs-check-…

@yashg I had no issues with creating snapshots to Minio. I haven’t used HTTPS, and this shouldn’t be the case here. This is my working configuration for Minio and official OpenSearch Helm charts. config: # Values must be YAML literal style scalar / YAML multiline string. # <filename>: | # <…

[image] Repository-s3: Delete snapshot operation times out without issuing DeleteObject request to MinIO OpenSearch Hi @yashg , I’m not sure if you tested HTTP on your side, but I had some time to test HTTPS on mine. I was able to reproduce your issue by enabli…

PKIX path building failed when trying to connect Opensearch to minio with https

OpenSearch

pablo August 10, 2026, 1:19pm 11

Topic		Replies	Views
In Opensearch failed to register repo with MINIO S3 using "HTTPS" protocol OpenSearch troubleshoot , configure , feature-request	3	641	March 15, 2024
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Security	6	1114	April 24, 2024
Opensearch fails to start with default configuration (demo install) OpenSearch	5	3279	February 2, 2025
Caused by: org.opensearch.OpenSearchException: Unable to read the file root-ca.pem. Please make sure this files exists and is readable regarding to permissions OpenSearch configure , install , security-issue	11	1051	March 24, 2025
Using Helm chart, demo install with default certs fails to start error OpenSearch install	9	1512	September 28, 2024

PKIX path building failed when trying to connect Opensearch to minio with https

Related topics