# Adding CA Cert when using KDB+ Studio

**URL:** <https://forum.kx.com/t/adding-ca-cert-when-using-kdb-studio/11912>\
**Category:** Community Support\
**Tags:** kdb-and-q\
**Created:** [June 1, 2019, 2:04am UTC](https://forum.kx.com/t/adding-ca-cert-when-using-kdb-studio/11912 "2019-06-01T02:04:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Light\_of\_Heaven](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@Light\_of\_Heaven](https://forum.kx.com/u/Light_of_Heaven)\
**Post date:** [June 1, 2019, 2:04am UTC](https://forum.kx.com/t/adding-ca-cert-when-using-kdb-studio/11912/1 "2019-06-01T02:04:00Z")

</div>

Hello,

I configured TLS/SSL

> **q)(-26!)[]**  
> **SSLEAY\_VERSION&nbsp; &nbsp;| OpenSSL 1.0.2n&nbsp; 7 Dec 2017**  
> **SSL\_CERT\_FILE&nbsp; &nbsp; | /tls/tls.crt**  
> **SSL\_CA\_CERT\_FILE | /usr/lib/ssl/cacert.pem**  
> **SSL\_CA\_CERT\_PATH | /usr/lib/ssl**  
> **SSL\_KEY\_FILE&nbsp; &nbsp; &nbsp;| /tls/tls.key**  
> **SSL\_CIPHER\_LIST&nbsp; | ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:..**  
> **SSL\_VERIFY\_CLIENT| NO**  
> **SSL\_VERIFY\_SERVER| YES**

On kdb+ studio I get the attached error (see image).

\<blockquote class=“imgur-embed-pub” lang=“en” data-id=“a/G8Ocy8w” data-context=“false” \>\<a href=“[//imgur.com/a/G8Ocy8w](https://imgur.com/a/G8Ocy8w)”\>\</a\>\</blockquote\>\<script async src=“[//s.imgur.com/min/embed.js](https://s.imgur.com/min/embed.js)” charset=“utf-8”\>\</script\>

On the server side I get a predictable&nbsp;'2019.06.01T00:39:36.192 TLS only

p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Menlo; color: #ffffff; background-color: #2b66c9}span.s1 {font-variant-ligatures: no-common-ligatures}

&nbsp;

Where does my CA cert need to be placed? I have it in my keychain but it’s not working.

Thanks

---

<div class="post-metadata">

**Author:** ![Sam\_McMillen](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@Sam\_McMillen](https://forum.kx.com/u/Sam_McMillen)\
**Post date:** [June 4, 2019, 10:20am UTC](https://forum.kx.com/t/adding-ca-cert-when-using-kdb-studio/11912/2 "2019-06-04T10:20:00Z")

</div>

Hi Tom,

Have you tried testing whether you can make a secure connection between a q session and the server? The commit message here has some instructions for configuring certs:&nbsp;https://github.com/CharlesSkelton/studio/commit/135b84cb6fdb26869d70af50bc9c204274c57f43

Regards

Sam

---

<div class="post-metadata">

**Author:** ![Light\_of\_Heaven](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@Light\_of\_Heaven](https://forum.kx.com/u/Light_of_Heaven)\
**Post date:** [June 5, 2019, 2:37am UTC](https://forum.kx.com/t/adding-ca-cert-when-using-kdb-studio/11912/3 "2019-06-05T02:37:00Z")

</div>

Thanks for the quick reply Sam.

I was able to fix it by a&nbsp; **sudo keytool -importcert -alias dev -file /Users/homefolder/Downloads/certificate.cer -keystore /Library/Java/JavaVirtualMachines/jdk-12.0.1.jdk/Contents/Home/lib/security/cacerts**

Needed to import the CA into the Java trusted CA file

---

<div class="post-metadata">

**Author:** ![Light\_of\_Heaven](https://avatars.discourse-cdn.com/v4/letter/l/8edcca/32.png) [@Light\_of\_Heaven](https://forum.kx.com/u/Light_of_Heaven)\
**Post date:** [June 5, 2019, 2:45am UTC](https://forum.kx.com/t/adding-ca-cert-when-using-kdb-studio/11912/4 "2019-06-05T02:45:00Z")

</div>

As an extension of my previous question, now that I’m able to connect, whenever I run a query that takes longer then 30 seconds I get “Remote host terminated the handshake”. When I open a terminal and try to communicate through IPC I get my handle closed on me. Any query shorter than around 30 seconds is fine. Does this have to do with the payload under TLS? It seems like TLS with KDB is black magic. Do you know why this is the case?

Picture attached.

Thanks,

Tom