elastic/elasticsearch · critical · UserException

CONFIG

CONFIG

Error message

Elasticsearch secure settings not configured

What it means

Thrown by ServerCli.execute() when, after loading and optional auto-configuration, the SecureSettings object is still null. This means no keystore/file-secrets source provided credentials and auto-configuration did not produce any — ES cannot start without secure settings when security is expected.

Source

Thrown at distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/ServerCli.java:106

        validateConfig(options, env);

        var secureSettingsLoader = secureSettingsLoader(processInfo);

        try (
            var loadedSecrets = secureSettingsLoader.load(env, terminal);
            var password = (loadedSecrets.password().isPresent()) ? loadedSecrets.password().get() : new SecureString(new char[0]);
        ) {
            SecureSettings secrets = loadedSecrets.secrets();
            if (secureSettingsLoader.supportsSecurityAutoConfiguration()) {
                env = autoConfigureSecurity(terminal, options, processInfo, env, password);
                // reload or create the secrets
                secrets = secureSettingsLoader.bootstrap(env, password);
            }

            // we should have a loaded or bootstrapped secure settings at this point
            if (secrets == null) {
                throw new UserException(ExitCodes.CONFIG, "Elasticsearch secure settings not configured");
            }

            // install/remove plugins from elasticsearch-plugins.yml
            syncPlugins(terminal, env, processInfo);

            ServerArgs args = createArgs(options, env, secrets, processInfo);
            prepareLaunch(terminal, processInfo, args, options.has(daemonizeOption));
        }
    }

    private static void printVersion(Terminal terminal) {
        final String versionOutput = String.format(
            Locale.ROOT,
            "Version: %s, Build: %s/%s/%s, JVM: %s",
            Build.current().qualifiedVersion(),
            Build.current().type().displayName(),
            Build.current().hash(),
            Build.current().date(),

View on GitHub (pinned to db6a809a66)

Solutions

1. Run bin/elasticsearch-reset-password or the auto-configuration flow (bin/elasticsearch on a fresh install auto-configures security on default distributions).
2. If you removed the keystore, recreate it: bin/elasticsearch-keystore create.
3. For file-settings deployments, provide a valid cluster_secrets block in the settings file.
4. Confirm ES_HOME/config and the keystore path are correct and readable.

Path keystore = env.configFile().resolve("elasticsearch.keystore");
if (Files.notExists(keystore) && !loader.supportsSecurityAutoConfiguration()) {
    throw new IllegalStateException("No keystore and no auto-config; create one: bin/elasticsearch-keystore create");
}

When it happens

Trigger: No elasticsearch.keystore (or AUTO-CONFIG scenario didn't run) and the file-settings loader returned EMPTY; supportsSecurityAutoConfiguration() was false and secrets came back null.

Common situations: First boot of a tar/zip distribution where bin/elasticsearch-create-enrollment-token / auto-conf was not invoked; keystore deleted; running with a file-settings loader that has no cluster_secrets and cannot bootstrap.

Related errors

• the ${keystoreType} keystore [${path}]does not contain a pri
• Failed to set the keystore password for {}
• could not resolve ssl client verification mode, unknown valu
• the truststore [${path}] does not contain any trusted certif
• supplied keystore file {} does not exist, require for {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/64f3dfa1b3a86d25. Report an issue: GitHub.