Before you dig into reading this guide, have you tried asking OpsGPT what this log means? You’ll receive a customized analysis of your log.
Try OpsGPT now for step-by-step guidance and tailored insights into your Elasticsearch operation.
Briefly, this error occurs when the Elasticsearch PKI (Public Key Infrastructure) Realm is configured to use a truststore that doesn’t contain any accepted certificate issuers. This means that the truststore cannot validate any client certificates. To resolve this issue, you can either add the necessary certificate issuers to the truststore or configure the PKI Realm to use a different truststore that already contains the accepted certificate issuers. Alternatively, you can disable the PKI Realm if it’s not needed.
For a complete solution to your to your search operation, try for free AutoOps for Elasticsearch & OpenSearch . With AutoOps and Opster’s proactive support, you don’t have to worry about your search operation – we take charge of it. Get improved performance & stability with less hardware.
This guide will help you check for common problems that cause the log ” PKI Realm {} uses truststore {} which has no accepted certificate issuers ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.
Log Context
Log “PKI Realm {} uses truststore {} which has no accepted certificate issuers” classname is PkiRealm.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
final String caKey = RealmSettings.getFullSettingKey(realmConfig; PkiRealmSettings.CAPATH_SETTING);
throw new IllegalArgumentException("[" + pathKey + "] and [" + caKey + "] cannot be used at the same time");
} else if (truststorePath != null) {
final X509TrustManager trustManager = trustManagersFromTruststore(truststorePath; realmConfig);
if (trustManager.getAcceptedIssuers().length == 0) {
logger.warn("PKI Realm {} uses truststore {} which has no accepted certificate issuers"; this; truststorePath);
}
return trustManager;
}
final X509TrustManager trustManager = trustManagersFromCAs(certificateAuthorities; realmConfig.env());
if (trustManager.getAcceptedIssuers().length == 0) {
