Does client verification require host based certificates?

Elastic Stack Logstash
1

When using ssl_verify_mode: force_peer for client verification with Filebeat, does the client certificate need to be issued to the specific host name/IP? I.e the CN is the host name of the node.

For example can I use (in a test/dev environment) one self-signed certificate for all of my four Filebeat nodes for client verification with a Logstash instance? Or do the certificates need to be issued to each node separately (CN = host1; CN = host2 etc)? I tried looking for an answer in the docs but could find any, sorry. Thanks!

2

That came up recently here. The name in the client certificiate is not checked.

3

We also try to make sure this ends up in the documentation: https://github.com/logstash-plugins/logstash-input-beats/issues/317