# Disabling Hostname Verification on Elasticsearch 7.16 Outbound Connections **URL:** \ **Category:** Elasticsearch\ **Created:** [April 12, 2023, 9:06am UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816 "2023-04-12T09:06:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![icey7z](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/icey7z/32/101676_2.png) [@icey7z](https://discuss.elastic.co/u/icey7z)\ **Post date:** [April 12, 2023, 9:06am UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816/1 "2023-04-12T09:06:23Z")
I'm trying to do a remote reindexing from a 5.3 cluster to a 7.16 cluster, and need a way to disable hostname verification when communicating between them. The 5.3 cluster's certificate doesn't match the hostname, and I would like to avoid changing the cert if I can. Failure response is ```auto { "error" : { "root_cause" : [ { "type" : "s_s_l_peer_unverified_exception", "reason" : "Host name '' does not match the certificate subject provided by the peer (CN=, OU=, O=\"\", C=US)" } ], "type" : "s_s_l_peer_unverified_exception", "reason" : "Host name '' does not match the certificate subject provided by the peer (CN=, OU= O=\"\", C=US)" }, "status" : 500 } ``` Per other threads I've found like [Disable hostname verification for xpack monitoring](https://discuss.elastic.co/t/disable-hostname-verification-for-xpack-monitoring/102893), I've tried setting `xpack.monitoring.elasticsearch.ssl.verification_mode: "certificate"` and `xpack.monitoring.elasticsearch.ssl.verificationMode: "certificate"` in `elasticsearch.yml`, but get the following back when trying to start Elasticsearch ```auto java.lang.IllegalArgumentException: unknown setting [xpack.monitoring.elasticsearch.ssl.verification_mode] please check that any required plugins are installed, or check the breaking changes documentation for removed settings at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:561) at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:507) at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:477) at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:447) at org.elasticsearch.common.settings.SettingsModule.(SettingsModule.java:137) at org.elasticsearch.node.Node.(Node.java:500) at org.elasticsearch.node.Node.(Node.java:309) at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:234) at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:234) at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:434) at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:166) at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:157) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) at org.elasticsearch.cli.Command.main(Command.java:77) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:122) at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80) For complete error details, refer to the log at ``` Is there actually a setting I can use to disable hostname verification here? ---
**Author:** ![TimBosman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timbosman/32/84120_2.png) [@TimBosman](https://discuss.elastic.co/u/TimBosman)\ **Post date:** [April 12, 2023, 9:33am UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816/2 "2023-04-12T09:33:19Z")
Hey Eric, Take a look at the `xpack.security.http.ssl.verification_mode` setting. This is the setting for the api. More information can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html#http-tls-ssl-settings). I hope this helps, Tim ---
**Author:** ![icey7z](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/icey7z/32/101676_2.png) [@icey7z](https://discuss.elastic.co/u/icey7z)\ **Post date:** [April 12, 2023, 7:43pm UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816/3 "2023-04-12T19:43:36Z")
Thanks Tim. I just tried applying that setting to the `elasticsearch.yml` files, and then restarted the cluster. However, I still get the same 500 error as above when I attempt to reindex. ---
**Author:** ![icey7z](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/icey7z/32/101676_2.png) [@icey7z](https://discuss.elastic.co/u/icey7z)\ **Post date:** [April 12, 2023, 7:49pm UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816/4 "2023-04-12T19:49:26Z")
Here's what I have in `elasticsearch.yml` ```auto xpack.security.enabled: true xpack.security.http.ssl.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.supported_protocols: ["TLSv1.2", "TLSv1.1", "TLSv1"] xpack.security.http.ssl.verification_mode: "certificate" xpack.security.http.ssl.keystore.type: BCFKS xpack.security.http.ssl.keystore.path: xpack.security.http.ssl.truststore.type: BCFKS xpack.security.http.ssl.truststore.path: xpack.security.transport.ssl.keystore.type: BCFKS xpack.security.transport.ssl.keystore.path: xpack.security.transport.ssl.truststore.type: BCFKS xpack.security.transport.ssl.truststore.path: xpack.notification.email.ssl.keystore.type: BCFKS xpack.notification.email.ssl.keystore.path: xpack.notification.email.ssl.truststore.type: BCFKS xpack.notification.email.ssl.truststore.path: xpack.security.fips_mode.enabled: false #xpack.security.fips_mode.enabled: true xpack.security.authc.password_hashing.algorithm: pbkdf2 stack.templates.enabled: false reindex.remote.whitelist: ``` ---
**Author:** ![icey7z](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/icey7z/32/101676_2.png) [@icey7z](https://discuss.elastic.co/u/icey7z)\ **Post date:** [April 12, 2023, 8:01pm UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816/5 "2023-04-12T20:01:16Z")
Turns out, the property I was looking for was ```auto reindex.ssl.verification_mode ``` all along! > **[Reindex API | Elasticsearch Guide \[8.7\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 10, 2023, 8:01pm UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816/6 "2023-05-10T20:01:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.