title: Disabling SSL verification for Elastic search Restclient not working in Java
body: <p>I am trying to connect to elastic search hosted in a gcp box. To connect to this, there is a SSL check and I need a certificate.</p>
  <p>However from these discussions, it is possible that we can turn off this verification.</p>
  <p><a href="https://stackoverflow.com/questions/57057074/how-to-disable-ssl-verification-for-elasticsearch-restclient-v6-7-0-in-java">How to disable SSL verification for Elasticsearch RestClient v6.7.0 in Java</a></p>
  <p><a href="https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618" rel="nofollow noreferrer">https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618</a></p>
  <p>I had tried to remove the verification. But it throwing the following error</p>
  <pre><code>javax.net.ssl.SSLHandshakeException: General SSLEngine problem
      at org.elasticsearch.client.RestClient$SyncResponseListener.get(RestClient.java:947)
      at org.elasticsearch.client.RestClient.performRequest(RestClient.java:229)
      at org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1762)
      at org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1732)
      at org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1694)
      at org.elasticsearch.client.RestHighLevelClient.search(RestHighLevelClient.java:1090)
      at org.dexter.lab.elasticUtils.ESUtils.getLastIndexedTimeStamp(ESUtils.java:44)
      at org.dexter.lab.druidUtils.DruidDelayChecker.main(DruidDelayChecker.java:357)
  Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
      at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1521)
      at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:528)
      at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1197)
      at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1165)
      at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doWrap(SSLIOSession.java:265)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:305)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:509)
      at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120)
      at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276)
      at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
      at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:588)
      at java.lang.Thread.run(Thread.java:748)
  Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
      at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1709)
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:318)
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
      at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
      at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
      at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
      at sun.security.ssl.Handshaker$1.run(Handshaker.java:970)
      at sun.security.ssl.Handshaker$1.run(Handshaker.java:967)
      at java.security.AccessController.doPrivileged(Native Method)
      at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:283)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:353)
      ... 9 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
      at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
      at sun.security.validator.Validator.validate(Validator.java:262)
      at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
      at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281)
      at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
      at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1626)
      ... 17 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
      at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
      at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
      at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
      ... 23 more
  </code></pre>
  <p>This is what I did:</p>
  <p>I did a override to verify function and returned true. So that it won't check. This is the code for that</p>
  <pre><code>restClientBuilder.setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {
                  @Override
                  public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpClientBuilder) {
                      return httpClientBuilder.setSSLHostnameVerifier(new HostnameVerifier() {
                          public boolean verify(String s, SSLSession sslSession) {
                              return true;
                          }
                      });
                  }
              });
  </code></pre>
  <p>I tried with another way as well as mentioned in the elastic thread</p>
  <pre><code>restClientBuilder.setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {
                  @Override
                  public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpClientBuilder) {
                      return httpClientBuilder.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
                  }
              });
  </code></pre>
  <p>I had generated a self signed certificate and it worked. I had enabled debug logs to see why a certificate is needed.</p>
  <p>These are the logs after adding certificate:</p>
  <pre><code>***
  Found trusted certificate:
  [
  [
    Version: V3
  </code></pre>
  <p>This was followed by details about certificate.</p>
  <p>The problem is I cannot generate self signed certificate for production environment and there I am getting exceptions for not using certificate even after overriding.</p>
  <p>Is there any possible work around for this ? Any help is greatly appreciated.</p>
  <p>Thanks in advance</p>