Elasticsearch "received plaintext http traffic on an https channel" in CI

By Daniel Zoghalchali·Latchkey

Elasticsearch 8 enables TLS on the HTTP layer by default, so the node speaks HTTPS. When your test client connects over plain http://, ES closes the connection and logs "received plaintext http traffic on an https channel". Use https, or disable security for the test instance.

What this error means

Requests to http://localhost:9200 hang or are reset, and the ES log shows "received plaintext http traffic on an https channel, closing connection".

received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{...}

Common causes

ES 8 ships with TLS enabled by default

In 8.x, xpack.security.enabled and HTTP TLS are on by default, so the node only accepts HTTPS. A plain HTTP client is rejected.

The client URL scheme is http://

Test config points at http://localhost:9200, which mismatches the node's HTTPS listener.

How to fix it

Disable security for the test node

For ephemeral CI, turn off security so the node serves plain HTTP. This is acceptable for a throwaway test instance.

- name: Start Elasticsearch (test mode)
  run: |
    docker run -d --name es -p 9200:9200 \
      -e discovery.type=single-node \
      -e xpack.security.enabled=false \
      docker.elastic.co/elasticsearch/elasticsearch:8.13.0

Or connect over https with the CA

Keep security on and use the generated CA certificate with an https URL.

curl --cacert http_ca.crt -u elastic:$ELASTIC_PASSWORD https://localhost:9200

How to prevent it

• Match the client scheme (http/https) to the node configuration.
• For CI, disabling security on a throwaway node keeps config simple.
• If keeping TLS, distribute the generated CA to the client.

Frequently asked questions

Related guides

References

• GitHub Actions documentation