Could not communicate if i add one more Public IP ssl comunication error

[cbeprem (Prem Kumar)]

Hi ALL,

The cluster has one master and three nodes configured via SSL and is working fine , with the below is the config .

cluster.name: techElasticlusterdata
node.name: elastciclustermaster-01
cluster.name: techElasticlusterdata
node.name: elastciclustermaster-01
network.host: [ elastciclustermaster-01.tech.com]
discovery.zen.ping.unicast.hosts: [" elastciclustermaster-01.tech.com"]
node.master: true
node.data: false
cluster.initial_master_nodes: [" elastciclustermaster-01"]

the domain name is pointed to the local ip address and communicate well with nodes . But i want to query through my public ip, when i add a domain name or public IP

network.host: [ elastciclustermaster-01.tech.com, server2.tech.com ]

OR

network.host: [ elastciclustermaster-01.tech.com, 61.0.0.5 ]

the cluster is started but it throws the following error

[ elastciclustermaster-01] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/104.248.0.76:43874}
[2019-09-02T15:29:51,938][WARN ][o.e.x.c.s.t.n.SecurityNetty4Transport] [ elastciclustermaster-01] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/104.248.0.76:43884}
brandmonitoring1. tech.com:5601

and i tried to curl

curl -XGET "https://10.136.149.134:9200/_cat/indices" -u elastic:! -k
{"error":{"root_cause":[{"type":"security_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":["Bearer realm="security"","ApiKey","Basic realm="security" charset="UTF-8""]}}],"type":"security_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":["Bearer realm="security"","ApiKey","Basic realm="security" charset="UTF-8""]}},"status":401}[root@bungeeelastciclustermaster-01 ~]#

Kindly help me

Regards,
Prem.

[ikakavas (Ioannis Kakavas)]

network.host is explained in https://www.elastic.co/guide/en/elasticsearch/reference/7.4/modules-network.html#common-network-settings . When you set it, this node advertises this to the other nodes and they try to connect to it there. However your TLS certificate doesn't contain this hostname as a SAN, so the connecting client that performs hostname validation as part of the SSL handshake, fails to verify the certificate and doesn't connect.

You can set http.host to your public IP instead, so that you (with your browser) can connect on the public hostname but nodes will continue to communicate on your local IP addresses

[cbeprem (Prem Kumar)]

Hi St,

Thanks , I will also try this

I have added the domain to work on public IP as well so the certificate gets the same domain and works on public and local ips. now it works fine .

Regards,
Prem.