# Could not communicate if i add one more Public IP ssl comunication error **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [September 2, 2019, 6:05pm UTC](https://discuss.elastic.co/t/could-not-communicate-if-i-add-one-more-public-ip-ssl-comunication-error/197727 "2019-09-02T18:05:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![cbeprem](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@cbeprem](https://discuss.elastic.co/u/cbeprem)\ **Post date:** [September 2, 2019, 6:05pm UTC](https://discuss.elastic.co/t/could-not-communicate-if-i-add-one-more-public-ip-ssl-comunication-error/197727/1 "2019-09-02T18:05:50Z")
Hi ALL, The cluster has one master and three nodes configured via SSL and is working fine , with the below is the config . cluster.name: techElasticlusterdata node.name: elastciclustermaster-01 cluster.name: techElasticlusterdata node.name: elastciclustermaster-01 network.host: [[elastciclustermaster-01.tech.com](http://elastciclustermaster-01.tech.com)] discovery.zen.ping.unicast.hosts: [" [elastciclustermaster-01.tech.com](http://elastciclustermaster-01.tech.com)"] node.master: true node.data: false cluster.initial\_master\_nodes: [" elastciclustermaster-01"] the domain name is pointed to the local ip address and communicate well with nodes . But i want to query through my public ip, when i add a domain name or public IP network.host: [[elastciclustermaster-01.tech.com](http://elastciclustermaster-01.tech.com), [server2.tech.com](http://server2.tech.com) ] OR network.host: [[elastciclustermaster-01.tech.com](http://elastciclustermaster-01.tech.com), 61.0.0.5 ] the cluster is started but it throws the following error [elastciclustermaster-01] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/104.248.0.76:43874} [2019-09-02T15:29:51,938][WARN][o.e.x.c.s.t.n.SecurityNetty4Transport] [elastciclustermaster-01] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/104.248.0.76:43884} brandmonitoring1. [tech.com:5601](http://tech.com:5601) and i tried to curl curl -XGET "[https://10.136.149.134:9200/\_cat/indices](https://10.136.149.134:9200/_cat/indices)" -u elastic:! -k {"error":{"root\_cause":[{"type":"security\_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":["Bearer realm="security"","ApiKey","Basic realm="security" charset="UTF-8""]}}],"type":"security\_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":["Bearer realm="security"","ApiKey","Basic realm="security" charset="UTF-8""]}},"status":401}[root@bungeeelastciclustermaster-01 ~]# Kindly help me Regards, Prem. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [September 6, 2019, 2:48pm UTC](https://discuss.elastic.co/t/could-not-communicate-if-i-add-one-more-public-ip-ssl-comunication-error/197727/2 "2019-09-06T14:48:55Z")
`network.host` is explained in [https://www.elastic.co/guide/en/elasticsearch/reference/7.4/modules-network.html#common-network-settings](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/modules-network.html#common-network-settings) . When you set it, this node advertises this to the other nodes and they try to connect to it there. However your TLS certificate doesn't contain this hostname as a SAN, so the connecting client that performs hostname validation as part of the SSL handshake, fails to verify the certificate and doesn't connect. You can set `http.host` to your public IP instead, so that you (with your browser) can connect on the public hostname but nodes will continue to communicate on your local IP addresses ---
**Author:** ![cbeprem](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@cbeprem](https://discuss.elastic.co/u/cbeprem)\ **Post date:** [September 6, 2019, 3:54pm UTC](https://discuss.elastic.co/t/could-not-communicate-if-i-add-one-more-public-ip-ssl-comunication-error/197727/3 "2019-09-06T15:54:21Z")
Hi St, Thanks , I will also try this I have added the domain to work on public IP as well so the certificate gets the same domain and works on public and local ips. now it works fine . Regards, Prem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2019, 3:54pm UTC](https://discuss.elastic.co/t/could-not-communicate-if-i-add-one-more-public-ip-ssl-comunication-error/197727/4 "2019-10-04T15:54:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.