Hi, We have a cluster in which we have enabled TLS security. To enable the security we used the elastic cert utility to generate the cert and CA. While generation of the certs or the CA any of the prompts did not ask us about the Hostnames or IP. We generated just one certificate and used that cert…

[image] Set up transport TLS | Elastic Docs Configuring TLS between nodes is the basic security setup to prevent unauthorized nodes from accessing to your Elasticsearch cluster, and it's required... In this doc in the step 2 : On any single node, generate a…

What version are you on? (please always include that) [image] Umang_Pachaury: To enable the security we used the elastic cert utility to generate the cert and CA. [image] Umang_Pachaury: Are the certs generated with elasticsearch cert-util are bound by IP/Hostname? Yes assuming you us…

Thanks for the reply we are using elasticsearch version 8.15.1 We generated the certificates using the elasticsearch-certutil using the CA mode. Using that we generated single CA and single Certificate which we used in each and every node in our cluster and till now faced no issue. In the CA mode …

[image] Set up transport TLS | Elastic documentation Configuring TLS between nodes is the basic security setup to prevent unauthorized nodes from accessing to your Elasticsearch cluster, and it's required... We have followed this approach in this while creati…

[image] Umang_Pachaury: We have followed this approach in this while creating initial CA and Certificate. It does not ask for IP or hostname. So will the same certificate work when the IP for the hosts of the cluster will change? Yes but it determines the hostname automatically and thus ties …

[image] Regenerate the SSL Certificate that was auto-generated on setup of ElasticSearch Elastic Search Hello! We have been using Elasticsearch with Zammad on an Ubuntu server for several months, and we recently moved the server to a new IP address. Because Elasticsearch …

Hi Stephen, We tried it with the same old certificate and it worked. I guess the steps followed in the above doc does not bound the certificate with IP/Host, because it is mentioned to generate one certificate and copy it to other nodes in the cluster.

Hmmm my test showed bound to host name using the default method. Just to help me out can you show me where it says create one cert and copy to all the nodes?

Nope you are correct for transport .. For http interface they are bound to hostname and IP That was my confusion, apologies Are you still having issues?

[image] Umang_Pachaury: We tried it with the same old certificate and it worked. I guess the steps followed in the above doc does not bound the certificate with IP/Host, because it is mentioned to generate one certificate and copy it to other nodes in the cluster. I have created certi on A c…

Oh i see, No we are not facing any issues thanks.

Discuss the Elastic Stack

Are the Self Signed Certs bound by IP / Hostname

Elastic Security

stephenb (Stephen Brown) April 16, 2025, 5:29pm 6

Topic		Replies	Views
Regenerate the SSL Certificate that was auto-generated on setup of ElasticSearch Elastic Search	6	905	November 27, 2025
How to set up hostname correctly when generating certificates for cluster nodes Elasticsearch	1	64	August 21, 2024
Elasticsearch - authorization / certificates and change of IP [?] Elasticsearch	2	1693	February 9, 2020
Change the certificates Elasticsearch elastic-stack-security , docker	6	2411	May 21, 2021
Replacing Self-Signed Certificates with Corporate CA Certificates Elasticsearch elastic-stack-security	7	1855	March 9, 2023

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Are the Self Signed Certs bound by IP / Hostname

Related topics