title: How to Kafka Connect Elasticsearch with SSL?
body: <p>Hi after looking at <a href="https://docs.confluent.io/current/connect/kafka-connect-elasticsearch/configuration_options.html#security" rel="nofollow noreferrer">https://docs.confluent.io/current/connect/kafka-connect-elasticsearch/configuration_options.html#security</a>, I am not sure which config I need to Kafka Connect to an Elasticsearch endpoint at https.</p>
  
  <p>I am able to Kafka Connect to a different non-https Elasticsearch, and on a regular client, I can connect to https by turning off SSL verification.</p>
  
  <p>This example from a different service provider <a href="https://help.aiven.io/en/articles/2349675-aiven-kafka-elasticsearch-sink-connector" rel="nofollow noreferrer">https://help.aiven.io/en/articles/2349675-aiven-kafka-elasticsearch-sink-connector</a> makes it seem like <code>connection.url</code>, <code>connection.username</code>, and <code>connection.password</code> is enough for https, but I am getting the error:</p>
  
  <pre><code>org.apache.kafka.connect.errors.ConnectException: Couldn't start ElasticsearchSinkTask due to connection error:
      at io.confluent.connect.elasticsearch.jest.JestElasticsearchClient.&lt;init&gt;(JestElasticsearchClient.java:132)
      at io.confluent.connect.elasticsearch.jest.JestElasticsearchClient.&lt;init&gt;(JestElasticsearchClient.java:122)
      at io.confluent.connect.elasticsearch.ElasticsearchSinkTask.start(ElasticsearchSinkTask.java:122)
      at io.confluent.connect.elasticsearch.ElasticsearchSinkTask.start(ElasticsearchSinkTask.java:51)
      at org.apache.kafka.connect.runtime.WorkerSinkTask.initializeAndStart(WorkerSinkTask.java:300)
      at org.apache.kafka.connect.runtime.WorkerSinkTask.execute(WorkerSinkTask.java:189)
      at org.apache.kafka.connect.runtime.WorkerTask.doRun(WorkerTask.java:175)
      at org.apache.kafka.connect.runtime.WorkerTask.run(WorkerTask.java:219)
      at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
      at java.util.concurrent.FutureTask.run(FutureTask.java:266)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
      at java.lang.Thread.run(Thread.java:748)
  
  Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
      at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
      at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
      at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
      at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
      at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
      at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394)
      at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353)
      at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:141)
      at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)
      at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)
      at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
      at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)
      at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:88)
      at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
      at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
      at io.searchbox.client.http.JestHttpClient.executeRequest(JestHttpClient.java:115)
      at io.searchbox.client.http.JestHttpClient.execute(JestHttpClient.java:57)
      at io.confluent.connect.elasticsearch.jest.JestElasticsearchClient.getServerVersion(JestElasticsearchClient.java:206)
      at io.confluent.connect.elasticsearch.jest.JestElasticsearchClient.&lt;init&gt;(JestElasticsearchClient.java:130)
      ... 12 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
      at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
      at sun.security.validator.Validator.validate(Validator.java:260)
      at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
      at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
      at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
      at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
      ... 34 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
      at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
      at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
      at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
      ... 40 more
  
  </code></pre>
  
  <p>Running Confluent 5.2.2 locally, Elasticsearch 6.8.3.</p>
  
  <p>Config:</p>
  
  <pre><code>{
    "name": "sink-elasticsearch-mytable-ssl",
    "config": {
      "connector.class": "io.confluent.connect.elasticsearch.ElasticsearchSinkConnector",
      "value.converter": "io.confluent.connect.avro.AvroConverter",
      "key.converter": "io.confluent.connect.avro.AvroConverter",
      "key.converter.schema.registry.url": "http://localhost:8081",
      "value.converter.schema.registry.url": "http://localhost:8081",
  
      "connection.url": "https://xxx.databases.appdomain.cloud:30810",
      "connection.username": "ibm_cloud_xxx",
      "connection.password": "xxx",
  
      "type.name": "type.name=kafka-connect",
      "topics": "postgresql-mytable",
      "key.ignore": true
    }
  }
  </code></pre>
  
  <p>I am using a managed Elasticsearch service, so all I have been given is the username/password and TLS cert, so I don't see keystore/truststore stuff. What is the rest of what I need to Kafka Connect Elasticsearch with SSL?</p>