# SSL certificate problem for Notification **URL:** https://forum.opensearch.org/t/ssl-certificate-problem-for-notification/22513 **Category:** Alerting **Created:** [November 20, 2024, 4:47am UTC](https://forum.opensearch.org/t/ssl-certificate-problem-for-notification/22513 "2024-11-20T04:47:11Z") **Posts on this page:** 1 **Showing post:** 4
### Author: ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo) #### Post date: [December 16, 2024, 4:47pm UTC](https://forum.opensearch.org/t/ssl-certificate-problem-for-notification/22513/4 "2024-12-16T16:47:28Z")
@mouse Was it signed by the external Certificate Authority? If not, then your rootCA is still self-signed. The fact that you must place the rootCA in each node means that rootCA is not well known CA. Could you check this solution? Placing your root CA in Java’s keystore may solve your issue. > [@What CA is used by notifications channels?](https://forum.opensearch.org/t/what-ca-is-used-by-notifications-channels/11451/4): > > SOLVED Solved the issue after a good deal of trial and error. The notification channels outgoing httpclient uses the Java Runtime trust store, and NOT the opensearch truststore for verifying connections. This is important, as it means you will have to trust your CA with Javas cacerts truststore as well. This can be done by: Access your container as root, in order to have sufficient privileges: docker exec -u root -it opensearch\_container\_name bash Read your existing truststore and veri… --- _[View the full topic](https://forum.opensearch.org/t/ssl-certificate-problem-for-notification/22513)._