How to fix certificate verify failed error (self-signed)

Technical assistance
1

Infos:

  • Used Zammad version: 6.1
  • Used Zammad installation type: package
  • Operating system: Ubuntu 22.04

Expected behavior:

  • Build the search index successfully
    $ sudo zammad run rake zammad:searchindex:rebuild

Actual behavior:

  • $ sudo zammad run rails r “Setting.set(‘es_url’, ‘https://localhost:9200’)”
  • $ sudo zammad run rails r “Setting.set(‘es_user’, ‘myuser’)”
  • $ sudo zammad run rails r “Setting.set(‘es_password’, ‘mypw’)”
  • $ sudo zammad run rake zammad:searchindex:rebuild
rake aborted!
Unable to process GET request to elasticsearch URL 'https://localhost:9200'. Check the response and payload for detailed information:

Response:
#<UserAgent::Result:0x00007fce2a9f3f08 @success=false, 
@body=nil, @data=nil, @code=0, @content_type=nil, 
@error="#<OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 peeraddr=127.0.0.1:9200 state=error: certificate verify failed (self-signed certificate in certificate chain)>", 
@header=nil>

Payload:
null

Payload size: 0M
/opt/zammad/lib/search_index_backend.rb:36:in `info'
/opt/zammad/lib/tasks/zammad/search_index_es.rake:64:in `block (3 levels) in <main>'
/opt/zammad/vendor/bundle/ruby/3.1.0/gems/rake-13.0.6/exe/rake:27:in `<top (required)>'
/opt/zammad/bin/bundle:121:in `load'
/opt/zammad/bin/bundle:121:in `<main>'
Tasks: TOP => zammad:searchindex:rebuild => zammad:searchindex:version_supported
(See full trace by running task with --trace)

Steps to reproduce the behavior:

  • Follow the installation guide and install a fresh installation of elasticsearch and zammad. Change ‘es_url’ to ‘https://localhost:9200’. Install SSL certs for the host using letsencrypt and certbot.

Dear Community

My question is: how can I fix the self-signed cert problem after the default elasticsearch installation? If I run sudo zammad run rails r "Setting.set('es_ssl_verify', false)" the command zammad run rake zammad:searchindex:rebuild works.

Kind regards
Nicolas

2

Am I missing something? Is there more information on how to properly set up Elasticsearch and Zammad for a production environment?

How do you configure this when you do a package installation?

3

If you’re using a local Elasticsearch, having a self signed certificate you’re not verifying would be okay in my opinion.

The official elasticsearch documentation has you covered if you want to use your own / different certificates:

4

Okay, thank you very much for your answer. So you would simply set “Setting.set(‘es_ssl_verify’, false)” for Zammad when using a local Elasticsearch installation? Do you know of any production systems that handle it like this?

5

yes

I can’t disclose this information.

6

This topic was automatically closed 360 days after the last reply. New replies are no longer allowed.