{"record":{"id":"64f3dfa1b3a86d25","repo":"elastic/elasticsearch","slug":"config","errorCode":"CONFIG","errorMessage":"Elasticsearch secure settings not configured","messagePattern":"Elasticsearch secure settings not configured","errorType":"error_code","errorClass":"UserException","httpStatus":null,"severity":"critical","filePath":"distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/ServerCli.java","lineNumber":106,"sourceCode":"\n        validateConfig(options, env);\n\n        var secureSettingsLoader = secureSettingsLoader(processInfo);\n\n        try (\n            var loadedSecrets = secureSettingsLoader.load(env, terminal);\n            var password = (loadedSecrets.password().isPresent()) ? loadedSecrets.password().get() : new SecureString(new char[0]);\n        ) {\n            SecureSettings secrets = loadedSecrets.secrets();\n            if (secureSettingsLoader.supportsSecurityAutoConfiguration()) {\n                env = autoConfigureSecurity(terminal, options, processInfo, env, password);\n                // reload or create the secrets\n                secrets = secureSettingsLoader.bootstrap(env, password);\n            }\n\n            // we should have a loaded or bootstrapped secure settings at this point\n            if (secrets == null) {\n                throw new UserException(ExitCodes.CONFIG, \"Elasticsearch secure settings not configured\");\n            }\n\n            // install/remove plugins from elasticsearch-plugins.yml\n            syncPlugins(terminal, env, processInfo);\n\n            ServerArgs args = createArgs(options, env, secrets, processInfo);\n            prepareLaunch(terminal, processInfo, args, options.has(daemonizeOption));\n        }\n    }\n\n    private static void printVersion(Terminal terminal) {\n        final String versionOutput = String.format(\n            Locale.ROOT,\n            \"Version: %s, Build: %s/%s/%s, JVM: %s\",\n            Build.current().qualifiedVersion(),\n            Build.current().type().displayName(),\n            Build.current().hash(),\n            Build.current().date(),","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/ServerCli.java#L88-L124","documentation":"Thrown by ServerCli.execute() when, after loading and optional auto-configuration, the SecureSettings object is still null. This means no keystore/file-secrets source provided credentials and auto-configuration did not produce any — ES cannot start without secure settings when security is expected.","triggerScenarios":"No elasticsearch.keystore (or AUTO-CONFIG scenario didn't run) and the file-settings loader returned EMPTY; supportsSecurityAutoConfiguration() was false and secrets came back null.","commonSituations":"First boot of a tar/zip distribution where bin/elasticsearch-create-enrollment-token / auto-conf was not invoked; keystore deleted; running with a file-settings loader that has no cluster_secrets and cannot bootstrap.","solutions":["Run bin/elasticsearch-reset-password or the auto-configuration flow (bin/elasticsearch on a fresh install auto-configures security on default distributions).","If you removed the keystore, recreate it: bin/elasticsearch-keystore create.","For file-settings deployments, provide a valid cluster_secrets block in the settings file.","Confirm ES_HOME/config and the keystore path are correct and readable."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"Path keystore = env.configFile().resolve(\"elasticsearch.keystore\");\nif (Files.notExists(keystore) && !loader.supportsSecurityAutoConfiguration()) {\n    throw new IllegalStateException(\"No keystore and no auto-config; create one: bin/elasticsearch-keystore create\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["On first boot of a default distribution, let auto-configuration create the keystore.","Do not delete elasticsearch.keystore without a replacement plan.","For file-settings deployments, ensure cluster_secrets is populated."],"tags":["security","secure-settings","keystore","startup","config"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}