Indexer container sends the user to the credentials file when the problem is the ownership of its certificate files #2792

Description

When resolve-credentials.sh --prestart refuses to start, the Wazuh indexer entrypoint always ends with credentials: the indexer cannot start until the keys above are set in config/credentials/indexer.env and credentials: (created by tools/utils/deployment/credentials-conf.sh) (build-docker-images/wazuh-indexer/config/entrypoint.sh L107-L111). The lines above it can be about certificate files, not keys: here every line was UNSAFE .../certs/<file>.pem: owned by uid 101, not root, and indexer.env was complete. The user is sent to the passwords file, and to a script that the upgrade page says not to run again. The Wazuh manager and Wazuh dashboard entrypoints say "cannot start until the problems above are solved" for the same check, and the manager's also names the certificates directory.

Steps to reproduce

1. In a running single-node deployment of wazuh-docker v5.0.0-rc2, give a certificate a wrong owner: chown 101:101 config/wazuh_indexer/certs/indexer.pem.
2. Run docker compose restart wazuh.indexer, then docker compose logs wazuh.indexer.

We met it after following the upgrade page from a 5.0.0 RC 1 deployment, whose certificates-conf.sh left the certificates owned by uid 101. We didn't run steps 1 and 2 as such, but every refusal of --prestart ends with the same two lines.

Expected behavior

The last lines point to what the lines above report, as the Wazuh manager entrypoint does: for example credentials: the indexer cannot start until the problems above are solved: passwords go in config/credentials/indexer.env, certificates in config/wazuh_indexer/certs, owned by root with group 101 (certificates-conf.sh --priv sets them).

Actual behavior

single-node-wazuh.indexer  | UNSAFE /usr/share/wazuh-indexer/config/certs/indexer.pem: owned by uid 101, not root
single-node-wazuh.indexer  | UNSAFE /usr/share/wazuh-indexer/config/certs/root-ca.pem: owned by uid 101, not root
single-node-wazuh.indexer  | resolve-credentials: the files above must be corrected before the service starts
single-node-wazuh.indexer  | credentials: the indexer cannot start until the keys above are set in config/credentials/indexer.env
single-node-wazuh.indexer  | credentials: (created by tools/utils/deployment/credentials-conf.sh)

Proposed fix

Replace the two lines with a neutral message that covers both kinds of problem, as in the expected behavior above. Keep the "MISSING key" branch before it (L98-L104) as it is: it already handles missing keys.

Environment

• wazuh-docker v5.0.0-rc2, image wazuh/wazuh-indexer:5.0.0-rc2, single-node stack.
• Docker on Ubuntu 24.04.