testcontainers/testcontainers-java · error · IllegalStateException

Failed to copy Elasticsearch HTTP CA certificate from

Error message

Failed to copy Elasticsearch HTTP CA certificate from '{certPath}'. In managed HTTPS mode, KibanaContainer requires access to the Elasticsearch HTTP CA.

What it means

Thrown by copyElasticsearchHttpCaCertificateOrThrow when Testcontainers fails to copy the HTTP CA cert file out of the managed Elasticsearch container (any exception while reading elasticsearch.getCertPath()). In managed HTTPS mode KibanaContainer must read this CA to trust Elasticsearch's TLS certificate; without it Kibana cannot connect securely.

Solutions

1. Ensure the ElasticsearchContainer is running (or will be started) before the KibanaContainer is started, in the correct order.
2. Verify the Elasticsearch container actually generates the CA at getCertPath() — check that HTTPS/SSL is enabled on it.
3. Inspect the wrapped cause (this IllegalStateException is chained) for the underlying Docker/IO failure and fix that.

Example fix

// before
elasticsearch.stop();
kibana.start(); // fails: cannot copy CA from stopped container
// after
elasticsearch.start();
kibana.start();
// then stop both at the end

if (elasticsearch.getCertPath() == null || elasticsearch.getState().getRunning() != Boolean.TRUE) throw new IllegalStateException("ES container must be running with TLS before configuring Kibana");

try { kibana.start(); } catch (IllegalStateException e) { if (e.getMessage().startsWith("Failed to copy Elasticsearch HTTP CA certificate")) log.error("ES CA copy failed; check ES running state and cert path: " + e.getCause(), e); throw e; }

When it happens

Trigger: Managed mode with HTTPS enabled where copyFileFromContainer throws — Elasticsearch container stopped/not running at that point, the cert file missing inside the container (elasticsearch.getCertPath() wrong), or a Docker/API error during the copy.

Common situations: Starting KibanaContainer after the ElasticsearchContainer was already stopped; TLS config changed upstream so the cert path no longer exists; Docker daemon issues mid-copy.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Elasticsearch CA certificate cannot be empty
• Elasticsearch container has no network configuration
• Elasticsearch container is not connected to the expected…
• Failed to connect Elasticsearch container to ad-hoc shared…
• Exception while creating SSLSocketFactory

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/1c7bf8fd4aab8ab7. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:372

            }
        }

        // Elasticsearch 8.x+ has the security enabled by default, so lack of the env var set to false means security is enabled
        boolean securityDisabled = "false".equalsIgnoreCase(elasticsearch.getEnvMap().get("xpack.security.enabled"));

        if (!securityDisabled) {
            // Managed mode: authenticate Kibana -> Elasticsearch using a Kibana service account token.
            // This avoids any password lifecycle management for kibana_system.
            String token = createKibanaServiceAccountToken(protocol);
            addEnv("ELASTICSEARCH_SERVICEACCOUNTTOKEN", token);
        }
    }

    private byte[] copyElasticsearchHttpCaCertificateOrThrow() {
        try {
            return elasticsearch.copyFileFromContainer(elasticsearch.getCertPath(), IOUtils::toByteArray);
        } catch (Exception e) {
            throw new IllegalStateException(
                "Failed to copy Elasticsearch HTTP CA certificate from '" +
                elasticsearch.getCertPath() +
                "'. " +
                "In managed HTTPS mode, KibanaContainer requires access to the Elasticsearch HTTP CA.",
                e
            );
        }
    }

    private void ensureCorrectNetworkSetupForManagedMode() {
        Network esNetwork = elasticsearch.getNetwork();
        Network kbNetwork = this.getNetwork();

        if ((esNetwork == null) != (kbNetwork == null)) {
            throw new IllegalStateException(
                "Managed mode requires either both containers share the same explicit network, " +
                "or neither specifies a network (KibanaContainer will create one). "
            );

View on GitHub (pinned to 8e549514e3)