{"record":{"id":"1c7bf8fd4aab8ab7","repo":"testcontainers/testcontainers-java","slug":"failed-to-copy-elasticsearch-http-ca-certificate-from","errorCode":null,"errorMessage":"Failed to copy Elasticsearch HTTP CA certificate from '{certPath}'. In managed HTTPS mode, KibanaContainer requires access to the Elasticsearch HTTP CA.","messagePattern":"Failed to copy Elasticsearch HTTP CA certificate from '(.+?)'\\. In managed HTTPS mode, KibanaContainer requires access to the Elasticsearch HTTP CA\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java","lineNumber":372,"sourceCode":"            }\n        }\n\n        // Elasticsearch 8.x+ has the security enabled by default, so lack of the env var set to false means security is enabled\n        boolean securityDisabled = \"false\".equalsIgnoreCase(elasticsearch.getEnvMap().get(\"xpack.security.enabled\"));\n\n        if (!securityDisabled) {\n            // Managed mode: authenticate Kibana -> Elasticsearch using a Kibana service account token.\n            // This avoids any password lifecycle management for kibana_system.\n            String token = createKibanaServiceAccountToken(protocol);\n            addEnv(\"ELASTICSEARCH_SERVICEACCOUNTTOKEN\", token);\n        }\n    }\n\n    private byte[] copyElasticsearchHttpCaCertificateOrThrow() {\n        try {\n            return elasticsearch.copyFileFromContainer(elasticsearch.getCertPath(), IOUtils::toByteArray);\n        } catch (Exception e) {\n            throw new IllegalStateException(\n                \"Failed to copy Elasticsearch HTTP CA certificate from '\" +\n                elasticsearch.getCertPath() +\n                \"'. \" +\n                \"In managed HTTPS mode, KibanaContainer requires access to the Elasticsearch HTTP CA.\",\n                e\n            );\n        }\n    }\n\n    private void ensureCorrectNetworkSetupForManagedMode() {\n        Network esNetwork = elasticsearch.getNetwork();\n        Network kbNetwork = this.getNetwork();\n\n        if ((esNetwork == null) != (kbNetwork == null)) {\n            throw new IllegalStateException(\n                \"Managed mode requires either both containers share the same explicit network, \" +\n                \"or neither specifies a network (KibanaContainer will create one). \"\n            );","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java#L354-L390","documentation":"Thrown by copyElasticsearchHttpCaCertificateOrThrow when Testcontainers fails to copy the HTTP CA cert file out of the managed Elasticsearch container (any exception while reading elasticsearch.getCertPath()). In managed HTTPS mode KibanaContainer must read this CA to trust Elasticsearch's TLS certificate; without it Kibana cannot connect securely.","triggerScenarios":"Managed mode with HTTPS enabled where copyFileFromContainer throws — Elasticsearch container stopped/not running at that point, the cert file missing inside the container (elasticsearch.getCertPath() wrong), or a Docker/API error during the copy.","commonSituations":"Starting KibanaContainer after the ElasticsearchContainer was already stopped; TLS config changed upstream so the cert path no longer exists; Docker daemon issues mid-copy.","solutions":["Ensure the ElasticsearchContainer is running (or will be started) before the KibanaContainer is started, in the correct order.","Verify the Elasticsearch container actually generates the CA at getCertPath() — check that HTTPS/SSL is enabled on it.","Inspect the wrapped cause (this IllegalStateException is chained) for the underlying Docker/IO failure and fix that."],"exampleFix":"// before\nelasticsearch.stop();\nkibana.start(); // fails: cannot copy CA from stopped container\n// after\nelasticsearch.start();\nkibana.start();\n// then stop both at the end","handlingStrategy":"try-catch","validationCode":"if (elasticsearch.getCertPath() == null || elasticsearch.getState().getRunning() != Boolean.TRUE) throw new IllegalStateException(\"ES container must be running with TLS before configuring Kibana\");","typeGuard":null,"tryCatchPattern":"try { kibana.start(); } catch (IllegalStateException e) { if (e.getMessage().startsWith(\"Failed to copy Elasticsearch HTTP CA certificate\")) log.error(\"ES CA copy failed; check ES running state and cert path: \" + e.getCause(), e); throw e; }","preventionTips":["Start the ElasticsearchContainer before the KibanaContainer","Stop containers in reverse order (Kibana first, Elasticsearch last)","Confirm HTTPS/SSL is enabled on Elasticsearch so the CA is generated at getCertPath()"],"tags":["elasticsearch","tls","testcontainers","file-copy","docker"],"backgroundTag":"file-read-failed","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}