Elasticsearch "unable to find valid certification path" (TLS) in CI

By Daniel Zoghalchali·Latchkey

Elasticsearch 8.x serves HTTPS with a self-signed certificate by default. A client that does not trust that certificate aborts the TLS handshake with "unable to find valid certification path to requested target". For CI you either trust the generated CA or disable transport security for the test cluster.

What this error means

A Java client throws "PKIX path building failed: ... unable to find valid certification path to requested target", or a curl / Python client reports a self-signed certificate error against port 9200.

javax.net.ssl.SSLHandshakeException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid
certification path to requested target

Common causes

The 8.x self-signed HTTP certificate is untrusted

The node auto-generates a CA and certificate on first start; a client with the default trust store does not know that CA.

The client expects plain HTTP

Test code written for a 7.x open cluster connects over HTTP or with no CA configured, so it cannot validate the 8.x HTTPS certificate.

How to fix it

Disable HTTP TLS for a throwaway test cluster

1. Set xpack.security.enabled=false, which also turns off HTTP TLS.
2. The node then serves plain HTTP on 9200 and no certificate is needed.
3. Use this only for ephemeral CI clusters.

env:
  discovery.type: single-node
  xpack.security.enabled: "false"

Or trust the generated CA

Keep security on and point the client at the CA certificate the node generated (copy http_ca.crt out of the container and configure the client trust store with it).

# extract the auto-generated CA and trust it in the client
docker cp es:/usr/share/elasticsearch/config/certs/http_ca.crt ./http_ca.crt
curl --cacert ./http_ca.crt -u elastic:"$ELASTIC_PASSWORD" https://localhost:9200

How to prevent it

• Decide up front whether CI uses plain HTTP or trusts the generated CA.
• Do not disable certificate verification in client code; trust the CA instead.
• Pin the Elasticsearch version so TLS defaults stay predictable.

Frequently asked questions

Related guides

References

• GitHub Actions documentation