From 80ea1a5a37ed0ee2a3fd006f7227fcc7fe03fe3b Mon Sep 17 00:00:00 2001
From: Jennie Soria <predogma@users.noreply.github.com>
Date: Fri, 1 Mar 2024 15:00:59 -0500
Subject: [PATCH] Update geoip.asciidoc

The GeoIP endpoint does not use the xpack http client.
The GeoIP downloader uses the JDKs builtin cacerts.

If customer is using custom https endpoint they need to provide the cacert in the jdk, whether our jdk bundled in or their jdk. Otherwise they will see something like

```
...PKiX path building failed: sun.security.provier.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target...
```
---
 docs/reference/ingest/processors/geoip.asciidoc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/reference/ingest/processors/geoip.asciidoc b/docs/reference/ingest/processors/geoip.asciidoc
index 77572f707f4cb..7a0310c68346f 100644
--- a/docs/reference/ingest/processors/geoip.asciidoc
+++ b/docs/reference/ingest/processors/geoip.asciidoc
@@ -435,6 +435,8 @@ each node's <<es-tmpdir,temporary directory>> at `$ES_TMPDIR/geoip-databases/<no
 Note that {es} will make a GET request to `${ingest.geoip.downloader.endpoint}?elastic_geoip_service_tos=agree`,
 expecting the list of metadata about databases typically found in `overview.json`.
 
+The GeoIP downloader uses the JDKs builtin cacerts. If custom endpoint is used add the custom https endpoint cacert(s) to the JDK's truststore.
+
 [[ingest-geoip-downloader-poll-interval]]
 `ingest.geoip.downloader.poll.interval`::
 (<<dynamic-cluster-setting,Dynamic>>, <<time-units,time value>>)