# When trying to install and configure opensearch getting the below error **URL:** \ **Category:** Security\ **Tags:** troubleshoot, configure\ **Created:** [August 9, 2024, 4:32am UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748 "2024-08-09T04:32:22Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![redsanj](https://avatars.discourse-cdn.com/v4/letter/r/eb8c5e/32.png) [@redsanj](https://forum.opensearch.org/u/redsanj)\ **Post date:** [August 9, 2024, 4:32am UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748/1 "2024-08-09T04:32:22Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): Version- Opensearch-2.11.1 **Describe the issue** : ./securityadmin.sh -cd Path/to/opensearch-security/ -cacert /Path/to/config/root-ca.pem -cert Path/to/opensearch-2.11.1/config/admin.pem -key Path/to/opensearch-2.11.1/config/admin-key.pem -icl -nhnv * * * \*\* This tool will be deprecated in the next major release of OpenSearch \*\* \*\* [[DEPRECATION] Security Plugin Tools will be replaced · Issue #1755 · opensearch-project/security · GitHub](https://github.com/opensearch-project/security/issues/1755) \*\* * * * Security Admin v7 Will connect to localhost:9200 … done ERR: An unexpected IOException occured: Unrecognized SSL message, plaintext connection? Trace: java.io.IOException: Unrecognized SSL message, plaintext connection? at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:959) at org.opensearch.client.RestClient.performRequest(RestClient.java:333) at org.opensearch.client.RestClient.performRequest(RestClient.java:321) at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:573) at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:163) Caused by: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection? at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:145) at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:64) at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:612) at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:506) at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:482) at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:679) at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:279) at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:333) at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:545) at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120) at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162) at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337) at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315) at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276) at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104) at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:591) at java.base/java.lang.Thread.run(Thread.java:840) **Configuration** : **Relevant Logs or Screenshots** : ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [August 9, 2024, 10:13am UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748/2 "2024-08-09T10:13:50Z")
@redsanj I don’t see the hostname in the command so I assume you’re using localhost as destination. Did you turned off SSL on the 9200 endpoint in OpenSearch node? HTTPS is required on 9200 for securityadmin.sh script. ```auto plugins.security.ssl.http.enabled: true ``` ---
**Author:** ![redsanj](https://avatars.discourse-cdn.com/v4/letter/r/eb8c5e/32.png) [@redsanj](https://forum.opensearch.org/u/redsanj)\ **Post date:** [August 13, 2024, 8:46am UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748/3 "2024-08-13T08:46:37Z")
I have enabled the security. Hostname plugins.security.ssl.http.enabled: true ---
**Author:** ![redsanj](https://avatars.discourse-cdn.com/v4/letter/r/eb8c5e/32.png) [@redsanj](https://forum.opensearch.org/u/redsanj)\ **Post date:** [August 13, 2024, 8:47am UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748/4 "2024-08-13T08:47:51Z")
Can we use opensearch with http:// domainDNS:9200 instead of [https://domainDNS:9200](https://domainDNS:9200)? ---
**Author:** ![redsanj](https://avatars.discourse-cdn.com/v4/letter/r/eb8c5e/32.png) [@redsanj](https://forum.opensearch.org/u/redsanj)\ **Post date:** [August 13, 2024, 8:53am UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748/5 "2024-08-13T08:53:48Z")
when i disable the plugin security, the connectivity between opensearch and bitbucket is working fine but it is accepting any username and password. ```auto plugins.security.disabled: true ``` Could you please check? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [August 13, 2024, 11:58pm UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748/6 "2024-08-13T23:58:57Z")
> [@redsanj](#): > > when i disable the plugin security, the connectivity between opensearch and bitbucket is working fine but it is accepting any username and password. > > ```auto > plugins.security.disabled: true > > ``` > > Could you please check? This is correct. You don’t need to provide any credentials when the security plugin is disabled. However, I strongly advise to keep it enabled all the time. > [@redsanj](#): > > Can we use opensearch with http:// domainDNS:9200 instead of [https://domainDNS:9200](https://domainDNS:9200)? No, you cannot. The securityadmin.sh uses an SSL certificate to authenticate with the cluster using an SSL endpoint. ---
**Author:** ![KateWinslet](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/katewinslet/32/6694_2.png) [@KateWinslet](https://forum.opensearch.org/u/KateWinslet)\ **Post date:** [August 16, 2024, 1:15pm UTC](https://forum.opensearch.org/t/when-trying-to-install-and-configure-opensearch-getting-the-below-error/20748/7 "2024-08-16T13:15:08Z")
> [@redsanj](#): > > **Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): > Version- Opensearch-2.11.1 > > **Describe the issue** : > > ./securityadmin.sh -cd Path/to/opensearch-security/ -cacert /Path/to/config/root-ca.pem -cert Path/to/opensearch-2.11.1/config/admin.pem -key Path/to/opensearch-2.11.1/config/admin-key.pem -icl -nhnv > > * * * > > \*\* This tool will be deprecated in the next major release of OpenSearch \*\* > \*\* [[DEPRECATION] Security Plugin Tools will be replaced · Issue #1755 · opensearch-project/security · GitHub](https://github.com/opensearch-project/security/issues/1755) \*\* [DGME Paystub](https://dgmeinsider.site) > > * * * > > Security Admin v7 > Will connect to localhost:9200 … done > ERR: An unexpected IOException occured: Unrecognized SSL message, plaintext connection? > Trace: > java.io.IOException: Unrecognized SSL message, plaintext connection? > at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:959) > at org.opensearch.client.RestClient.performRequest(RestClient.java:333) > at org.opensearch.client.RestClient.performRequest(RestClient.java:321) > at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:573) > at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:163) > Caused by: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection? > at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:145) > at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:64) > at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:612) > at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:506) > at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:482) > at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:679) > at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:279) > at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:333) > at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:545) > at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120) > at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162) > at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337) > at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315) > at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276) > at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104) > at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:591) > at java.base/java.lang.Thread.run(Thread.java:840) The error suggests a mismatch between SSL/TLS configuration and plaintext connection. Verify that OpenSearch is correctly set up for SSL/TLS and ensure you are connecting to the correct port and using valid certificates. Double-check the configuration in opensearch.yml and make sure your securityadmin.sh script aligns with the SSL settings.