Elastic defend certificate error on windows when connecting to ES

Elastic Security Endpoint Security
1

Elastic agent is working and was registered with ca.crt file path on windows 2019 server.
Elastic defend integration failed to connect to ES with this message:"Elasticsearch connection failure"

Looking at logs give me a more precise issue:

elastic_agent.endpoint_security
[elastic_agent.endpoint_security][error] Http.cpp:327 CURL error 60: Error [SSL: no alternative certificate subject name matches target host name '192.168.1.111']

certificate config in elastic-endpoint.yaml is weird with blank lines:

image
image914×554 43.4 KB

How I can disable this check ? thanks for your help

2

Hi @pushou

This is happening because the hostname in the certificate being used to secure the connection is not the hostname for the connection (192.168.1.111). Are there other integrations also being used on this host that are working?

Regardless, if all you want to do is remove that hostname check, you can go to Fleet -> Settings then find the Output in use by the affected host(s) (by default it's default). Click the edit icon under the Actions column for it and you'll see a fly out appear on the right hand side of the page. In the
"Advanced YAML configuration" textbox add the below YAML and then click the "Save and apply setting" button. This will cause all integrations on all hosts writing to Elasticsearch using that Output configuration to disable that hostname check.

ssl:
  verification_mode: certificate

As an aside, full is the default verification mode and none disables all SSL verifications (but still uses SSL).

3

Thanks for your answer ferullo , I edited " Edit Elastic Defend integration" and set in advance settings "windows.advanced.elasticsearch.tls.verify_hostname" to false. Defend became "green" :grinning:

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.